SSD Advisory – TerraMaster TOS Unauthenticated Remote Command Execution

Vulnerability Summary
The following advisory describes a unauthenticated remote command execution found in TerraMaster TOS 3.0.33.
TOS is a “Linux platform-based operating system developed for TerraMaster cloud storage NAS server. TOS 3 is the third generation operating system newly launched.”
Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
Vendor response
The vendor stated that version 3.1.03 of TerraMaster TOS is no longer vulnerable to this vulnerability, the latest version of the software can be obtained from: http://download.terra-master.com/download.php.
(more…)

April 22, 2018 SecuriTeam Secure Disclosure 1 comment

SSD Advisory – TrendNet AUTHORIZED_GROUP Information Disclosure

Vulnerability Summary
The following advisory describes an information disclosure found in the following TrendNet routers:

  • TEW-751DR – v1.03B03
  • TEW-752DRU – v1.03B01
  • TEW733GR – v1.03B01

TRENDnet’s “N600 Dual Band Wireless Router, model TEW-751DR, offers proven concurrent Dual Band 300 Mbps Wireless N networking. Embedded GREENnet technology reduces power consumption by up to 50%. For your convenience this router comes pre-encrypted and features guest networks. Seamlessly stream HD video with this powerful router.”
Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
Vendor response
Several attempts to email TrendNet went unanswered, we have no idea what is the status of a fix or availability of a workaround.
CVE: CVE-2018-7034
(more…)

February 14, 2018 SecuriTeam Secure Disclosure 2 comments

SSD Advisory – Hack2Win – Cisco RV132W Multiple Vulnerabilities

Vulnerabilities Summary
The following advisory describes two (2) vulnerabilities found in Cisco RV132W Wireless N VPN version 1.0.1.8
The Cisco RV132W Wireless-N ADSL2+ VPN Router is “easy to use, set up, and deploy. This flexible router offers great performance and is suited for small or home offices (SOHO) and smaller deployments.”
The vulnerabilities found are:

  • Information Disclosure That Leads to Password Disclosure
  • Unauthenticated WAN Remote Code Execution

Credit
A security researcher from, NSHC, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program
Vendor response
Cisco were informed of the vulnerabilities and released patches to address them: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-rv13x
CVE: CVE-2018-0125 / CVE-2018-0127
(more…)

February 11, 2018 Hack2Win, SecuriTeam Secure Disclosure 1 comment

SSD Advisory – Multiple IoT Vendors – Multiple Vulnerabilities

Vulnerabilities summary
The following advisory describes three (3) vulnerabilities found in the following vendors:

  • Lorex
  • StarVedia
  • Eminent
  • Kraun

The vulnerabilities found:

  • Hard-coded credentials
  • Remote command injection (2)

It is possible to chain the vulnerabilities and to achieve unauthenticated remote command execution.
Credit
An independent security researcher, Robert Kugler (https://www.s3cur3.it), has reported this vulnerabilities to Beyond Security’s SecuriTeam Secure Disclosure program.
Vendor response
We tried to contact Lorex, Kraun and Eminent, attempts to establish contact went unanswered, therefore no details have been provided on a solution or a workaround.
StarVedia were informed of the vulnerabilities and released patches to address them – “These two issues were fixed before your contacting us”
(more…)

February 8, 2018 SecuriTeam Secure Disclosure 1 comment

SSD安全公告-GitStack未经验证的远程代码执行漏洞

漏洞概要
以下安全公告描述了在GitStack中存在的一个未经身份验证的动作，允许远程攻击者添加新用户，然后用于触发远程代码执行。
GitStack是一个可以让你设置你自己私人Git服务器的软件。 这意味着你可以创建一个没有任何内容的版本控制系统。GitStack可以非常容易的保持你的服务器是最新的。它是真正Git for Windows，并与任何其他Git客户端兼容。GitStack对于小团队来说是完全免费的。
(more…)

February 6, 2018 Chinese Translation, SecuriTeam Secure Disclosure 1 comment

SSD Advisory – Python Bytecode Disassembler and Decompiler (pycdc) Multiple Vulnerabilities

Vulnerabilities summary
The following advisory describes 12 (twelve) vulnerabilities found in Python Bytecode Disassembler and Decompiler (pycdc).
Python Bytecode Disassembler and Decompiler (pycdc) “aims to translate compiled Python byte-code back into valid and human-readable Python source code. While other projects have achieved this with varied success, Decompyle++ is unique in that it seeks to support byte-code from any version of Python.”
The vulnerabilities found are:

  • Heap buffer overflow (2)
  • Null pointer (8)
  • Global buffer overflow
  • Singed integer overflow

Credit
An independent security researcher from Geeknik Labs has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
Vendor response
Michael Hansen was informed of the vulnerability and release a patches to address them.
For more details: https://github.com/zrax/pycdc/commit/bf60a5831bd3d3c8aa0544c5aefab3310de5d615
PoC
At this time we will not disclose PoC – we may release these later when users of the python code have updated their systems.

February 4, 2018 SecuriTeam Secure Disclosure 1 comment

SSD Advisory – Hotspot Shield Information Disclosure

Vulnerability Summary
The following advisory describes a information disclosure found in Hotspot Shield.
Hotspot Shield “provides secure and private access to a free and open internet. Enabling access to social networks, sports, audio and video streaming, news, dating, gaming wherever you are.”
Credit
An independent security researcher, Paulos Yibelo, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
Vendor response
“Thank you very much again for contacting us. The info is being reviewed and if there are any questions/comments, we’ll contact you by re-opening this ticket”
CVE: CVE-2018-6460
(more…)

January 30, 2018 SecuriTeam Secure Disclosure 5 comments

SSD Advisory – iBall Multiple Vulnerabilities

Vulnerabilities summary
The following advisory describes two (2) vulnerabilities found in iB-WRA150N devices, firmware 1.2.6 build 110401 Rel.47776n.
iB-WRA150N is “a powerful solution to Internet connectivity at home, small offices and work stations. The key is if you are using an ADSL2+ connection now and later decide to change to Broadband or vice-versa you don’t need to change your router. This iBall router is 2-in-1 and compatible to both – Broadband connection as well as ADSL2 connection (Telephone connection or cable operator connection). ”
The vulnerabilities found are:

  • Hard coded accounts
  • Remote command execution

Credit
An independent security researcher, maxki4x, has reported this vulnerabilities to Beyond Security’s SecuriTeam Secure Disclosure program.
Vendor response
We tried to contact iBall since December 20 2017, repeated attempts to establish contact were answered, but no details have been provided on a solution or a workaround.
CVE: CVE-2018-6388
(more…)

January 29, 2018 SecuriTeam Secure Disclosure 2 comments

SSD Advisory – Oracle VirtualBox Multiple Guest to Host Escape Vulnerabilities

Vulnerabilities summary
The following advisory describes two (2) guest to host escape found in Oracle VirtualBox version 5.1.30, and VirtualBox version 5.2-rc1.
Credit
An independent security researcher, Niklas Baumstark, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
Vendor response
Oracle were informed of the vulnerabilities and released patches to address them.
For more details: http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
CVE: CVE-2018-2698
(more…)

January 24, 2018 SecuriTeam Secure Disclosure 5 comments

SSD安全公告-希捷个人云存储设备多个漏洞

漏洞概要
以下安全公告描述两个未经身份验证的命令注入漏洞。
希捷个人云家庭媒体存储设备是“存储，整理，流式传输，共享所有音乐，电影，照片和重要文档的最简单的方式”。
(more…)

January 22, 2018 Chinese Translation, SecuriTeam Secure Disclosure Comments Off on SSD安全公告-希捷个人云存储设备多个漏洞