PR08-24: Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection

[ProCheckUp Research]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

PR08-24: Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection

Vulnerability found: 2 May 2008

Vendor informed: 2 May 2008, 1st August 2008

Vulnerability fixed: no response was received from the vendor. A
workaround has been included in the "Fix" section.

Advisory publicly released: 9th October 2008

Severity: High

Credits: Adrian Pastor of ProCheckUp Ltd (www.procheckup.com)

Description:

Attackers can inject a malicious HTML/JavaScript payload via the
"system.sysName.0" SNMP OID. Such payload is returned on the web
interface when the administrator user views pages such as
'/config/configure-systems.html'. The injected code can perform any
actions within the context of the current session (full administrative
rights).

Although usually the SNMP write community string must be guessed/cracked
for a SNMP injection [1] attack to work, some embedded devices come with
SNMP read/write access enabled by default. Some examples include many
ZyXEL Prestige router models [2] used in residential and SOHO networks,
and also products used in corporate and government environments such as
the Proxim Tsunami MP.11 2411 Wireless Point-to-Multipoint System.

- From Proxim Tsunami MP.11 2411's user manual:

"
SNMP Read/Write Community Password

The password for read and write access to the MP.11/MP.11a using SNMP.
Enter a password in both the Password field and the Confirm field. The
default password is public.
"

Successfully tested on:

Tsunami MP.11 2411 Wireless Point-to-Multipoint System
Wireless Router v- v1.0.0 Bld#24 SN-03AT15620395 v3.0.3

Note: make/model and firmware version were obtained via the
iso.org.dod.internet.mgmt.mib-2.system.sysDescr.0 SNMP OID.


Proof of concept:

$ snmpset -v1 -c public 192.168.1.100 sysName.0 s
'"><script>alert(1)</script>'


Fix:

Disable SNMP write access. If SNMP write access is absolutely needed,
change the default read/write community string from "public" to a
non-predictable and hard-to-crack value.


References:

[1] "SNMP Joins Dark Side in New XSS Attack"
http://www.darkreading.com/document.asp?doc_id=147014

[2] "ZyXEL Gateways Vulnerability Research" (See section 2.3 Persistent
XSS via SNMP)
http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf

Tsunami MP.11 Model 2411 and Model 5054:
http://www.proxim.com/learn/library/datasheets/mp11_a4.pdf

ProCheckUp Security Vulnerabilities and Advisories:
http://www.procheckup.com/Vulnerabilities.php

Legal:

Copyright 2008 Procheckup Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the
Internet community for the purpose of alerting them to problems, if and
only if, the Bulletin is not edited
or changed in any way, is attributed to Procheckup, and provided such
reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. Procheckup is not
liable for any misuse of this information by any third party.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFI7gD0oR/Hvsj3i8sRAoQiAKCd1XGmckAOP8Pttn4KKi1uarV7DwCfZxAA
6QdkwHCtSbR50tVD9w99x/U=
=XFN4
-----END PGP SIGNATURE-----

[Vladimir '3APA3A' Dubrovin]

Dear ProCheckUp Research,

What can you achieve with script injection you can not achieve with
SNMP write access?

--Thursday, October 9, 2008, 5:02:44 PM, you wrote to bugtraq@securityfocus.com:

PR> $ snmpset -v1 -c public 192.168.1.100 sysName.0 s
'">><script>alert(1)</script>'


--
~/ZARAZA http://securityvulns.com/

[lee.e.rian@census.gov]

-----"Vladimir '3APA3A' Dubrovin" <3APA3A@SECURITY.NNOV.RU> wrote: -----

>What can you achieve with script injection you can not achieve
>with SNMP write access?

I don't know what you can actually achieve, but in addition to whatever you
can do to/with the box you have SNMP write access for, it gives you a shot
at the admin's machine. And maybe even a shot at everything that the
admin's machine can talk to.

Regards,
Lee


>
>--Thursday, October 9, 2008, 5:02:44 PM, you wrote to
>bugtraq@securityfocus.com:
>
>PR> $ snmpset -v1 -c public 192.168.1.100 sysName.0 s
>'">><script>alert(1)</script>'
>
>
>--
>~/ZARAZA http://securityvulns.com/

[Vladimir '3APA3A' Dubrovin]

Dear lee.e.rian@census.gov,

Why do you think you can't do it with SNMP? An examples are settings DNS
server option via DHCP (or DNS domain name for proxy server
autodiscovery protocol) or even configuring a VPN tunnel for all
traffic. I'm not sure about Tsunami, for Orinoco these settings are
read/write:

http://support.ipmonitor.com/mibs/ORINOCO-MIB/oids.aspx

see e.g. oriDHCPServerPrimaryDNSIPAddress

--Friday, October 10, 2008, 1:24:27 AM, you wrote to 3APA3A@SECURITY.NNOV.RU:

lercg> -----"Vladimir '3APA3A' Dubrovin" <3APA3A@SECURITY.NNOV.RU>
wrote: -----

>>What can you achieve with script injection you can not achieve
>>with SNMP write access?

lercg> I don't know what you can actually achieve, but in addition to
whatever you
lercg> can do to/with the box you have SNMP write access for, it gives
you a shot
lercg> at the admin's machine. And maybe even a shot at everything
that the
lercg> admin's machine can talk to.

lercg> Regards,
lercg> Lee


>>
>>--Thursday, October 9, 2008, 5:02:44 PM, you wrote to
>>bugtraq@securityfocus.com:
>>
>>PR> $ snmpset -v1 -c public 192.168.1.100 sysName.0 s
>>'">><script>alert(1)</script>'
>>
>>
>>--
>>~/ZARAZA http://securityvulns.com/


--
~/ZARAZA http://securityvulns.com/
Åñëè äàæå âû ïîëó÷èòå êàêîå-íèáóäü ïèñüìî, âû âñå ðàâíî íå ñóìååòå åãî ïðî÷èòàòü. (Òâåí)

[ProCheckUp Research]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi 3APA3A,

That's a good question, and here is my answer from the draft version of
an upcoming paper I'm working on:

"
Gaining SNMP write access to a device is already a compromise on its own
and usually considered a potential high risk security issue. Therefore,
one could argue that there is no point in launching a SNMP injection
attack when we can already change system settings via the SNMP write
community string. You might be wondering: why bother injecting a
HTML/JavaScript payload on the web console through SNMP when I can
change system parameters via SNMP alone?

In reality however, when a valid SNMP write community is identified, we
find that many OIDs cannot be changed due to read-only settings enforced
on that particular object. Instead, we are restricted to only being able
to change a limited number of OIDs.

What OIDs can be modified with a SNMP write community string depends on
two factors:

- - Specific vendor implementation of SNMP write permissions
- - SNMP RFCs

By being able to change a limited number of OIDs via a SNMP write
community string, the attacker might be able to DoS the device by
crippling its configuration settings or even deface some banners.
However, a serious attacker is ultimately interested in gaining full
access (admin/root) to the target device. Since identifying a valid SNMP
write community string might not be enough to accomplish such goal, it
makes sense to resort to SNMP injection.
"

Hope that helps.

Regards,
ap.

Vladimir '3APA3A' Dubrovin wrote:
> Dear ProCheckUp Research,
>
> What can you achieve with script injection you can not achieve with
> SNMP write access?
>
> --Thursday, October 9, 2008, 5:02:44 PM, you wrote to bugtraq@securityfocus.com:
>
> PR> $ snmpset -v1 -c public 192.168.1.100 sysName.0 s
> '">><script>alert(1)</script>'
>
>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFI7xPVoR/Hvsj3i8sRAlIUAJ9ZWNliZ18Akibq0R7XuHSDMiPCsQCdGZi8
Hrr0hjnddyfu+8pUqKeJcXk=
=UIm8
-----END PGP SIGNATURE-----