Category: Vulnerability Notes

CVE-2019-9529
The web application portal has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device.

CVE-2019-9530
The web root directory has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory.

CVE-2019-9531
The web application portal allows unauthenticated access to port 5454 on the device. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device.

CVE-2019-9532
The web application portal sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal.

CVE-2019-9533
The root password for the device is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device.

CVE-2019-9534
The device does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service. The CVSS score below reflects the score for this CVE in particular.

In addition to the findings above, we have found some configuration issues within the device that can leave it vulnerable to attackers. The default WiFi password is publicly documented as the serial number of the device and can be easily brute forced. Additionally, important security headers are missing, which leaves the device vulnerable to cross-site scripting and clickjacking.

References

Acknowledgements

This document was written by Kyle O’Meara and David Belasco of the CERT Coordination Center of the Carnegie Mellon Software Engineering Institute.

Other Information

Update iTerm2 to version 3.3.6, which includes mitigations against exploitation of this vulnerability. The latest version is available as an update within the program itself, or can be downloaded here. As the tmux integration cannot be disabled through configuration, a complete resolution is not yet available. We recommend that users of tmux integration follow the best practices outlined by iTerm2.

References

Acknowledgements

Thanks to Stefan Grönke and Fabian Freyer of Radically Open Security for finding this vulnerability, the Mozilla Open Source Support (MOSS) project for supporting the audit, and George Nachman of iTerm2 for developing the fix, and all parties for coordinating this vulnerability.

This document was written by Madison Oliver.

Other Information

The CVEs listed in the advisory are:

CVE-2019-11510 – Unauthenticated remote attacker with network access via HTTPS can send a specially crafted URI to perform an arbitrary file reading vulnerability.
CVE-2019-11509 – Authenticated attacker via the admin web interface can exploit this issue to execute arbitrary code on the Pulse Secure appliance.
CVE-2019-11508 – A vulnerability in the Network File Share (NFS) of Pulse Connect Secure allows an authenticated end-user attacker to upload a malicious file to write arbitrary files to the local system.
CVE-2019-11507 – A XSS issue has been found in Pulse Secure Application Launcher page. Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1, and 9.0.x before 9.0R3.
CVE-2019-11543 – A XSS issue found the admin web console. Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1.
CVE-2019-11542 – Authenticated attacker via the admin web interface can send a specially crafted message resulting in a stack buffer overflow.
CVE-2019-11541 – Users using SAML authentication with Reuse Existing NC (Pulse) Session option may see authentication leaks
CVE-2019-11540 – A vulnerability in the Pulse Secure could allow an unauthenticated, remote attacker to conduct a (end user) session hijacking attack.
CVE-2019-11539 – Authenticated attacker via the admin web interface allow attacker to inject and execute command injection
CVE-2019-11538 – A vulnerability in the Network File Share (NFS) of Pulse Connect Secure could allow an authenticated end-user attacker to access the contents of arbitrary files on the local file system.

Exploitation of these vulnerabilities was demonstrated at various events and proved to be highly impactful due to the direct access to admin privileges and the consequent ability to infect multiple VPN connected users and their desktops. Initially there was a lack of clarity about CVE-2019-11510, as to whether it can be mitigated with the requirement of a client-certificate or two-factor authentication (2FA) to prevent this attack. CERT/CC has confirmed with the vendor that this vulnerability cannot be mitigated using client certificate and furthermore there is no viable alternative to updating the Pulse Secure VPN software to a non-vulnerable version. Even if client certificates are required for user authentication, CVE-2019-11510 can be exploited by an unauthenticated remote attacker to obtain session IDs of active users stored in /data/runtime/mtmp/lmdb/randomVal/data.mdb. The attacker can use these session IDs to impersonate as one of the active users. If a Pulse Secure administrator is currently active and the administrative access is available to the attacker, attacker could gain administrative access to Pulse Secure VPN. It is highly recommended that all Pulse Secure VPN administrators perform the required upgrade on all their affected products. If your Pulse Secure VPN has been identified as End of Engineering (EOE) and End of Life (EOL), we highly recommend replacement of the VPN appliance entirely without any delay – please check Pulse Secure advisory for this information.

Timelines of specific events:
March 22, 2019 – Security researcher O. Tsai and M. Chang responsibly disclose vulnerability to Pulse Secure
April 24, 2019 – Initial advisory posted and software updates posted by Pulse Secure to the Download Center
April 25, 2019 – Assignment of CVE-2019-11510, CVE-2019-11509, CVE-2019-11508, CVE-2019-11507, CVE-2019-11543, CVE-2019-11542, CVE-2019-11541, CVE-2019-11540, CVE-2019-11539, CVE-2019-11538
April 26, 2019 – Workaround provided for CVE-2019-11508 about disabling file sharing as a mitigation
May 28 2019 – Large commercial vendors get reports of vulnerable VPN through HackerOne
July 31 2019 – Full RCE use of exploit demonstrated using the admin session hash to get complete shell
August 8 2019 – Meh Chang and Orange Tsai demonstrate the VPN issues across multiple vendors (Pulse Secure) with detailed attack on active VPN exploitation
August 24, 2019 – Bad Packets identifies over 14,500 vulnerable VPN servers globally still unpatched and in need of an upgrade
October 7, 2019 – NSA produces a Cybersecurity Advisory on Pulse Secure and other VPN products being targeted actively by Advanced Persistent Threat actors

There are no workarounds that address the other vulnerabilities.

References

Acknowledgements

This vulnerability was reported by Pulse Secure, who in turn credit Orange Tsai and Meh Chang from DEVCORE research team, and Jake Valletta from FireEye

This document was written by Vijay S Sarvepalli.

Other Information

1. The /apply_sec.cgi code is exposed to unauthenticated users.
2. The ping_ipaddr argument of the ping_test action fails to properly handle newline characters.

Any arguments after a newline character sent as ping_ipaddr in a POST to /apply_sec.cgi are executed on the device with root privileges. The following devices are reported to be vulnerable:

• DIR-655

• DIR-866L

• DIR-652

• DHP-1565

• DIR-855L

• DAP-1533

• DIR-862L

• DIR-615

• DIR-835

          DIR-825

We have made a proof-of-concept exploit available, which will disable network connectivity for one minute on affected devices.

Because D-Link is not providing updates to the devices listed above, it is important to replace any affected device with one that is currently supported by the vendor.

References

Acknowledgements

This vulnerability was coordinated and publicly disclosed by Fortinet’s FortiGuard Labs.

This document was written by Will Dormann.

Other Information

Up to and including Microsoft Excel 4.0, a macro format called XLM was available. XLM macros predate the VBA macros that are more common with modern Microsoft Office systems, however current Microsoft Office versions still support XLM macros.

SYLK and XLM macros

XLM macros can be incorporated into SYLK files, as outlined by Outflank. Macros in the SYLK format are problematic in that Microsoft Office does not open in Protected View to help protect users. This means that users may be a single click away from arbitrary code execution via a document that originated from the internet.

SYLK and XLM macros with Microsoft Office for Mac

It has been reported that Office 2011 for Mac fails to warn users before opening SYLK files that contain XLM macros. According to this post, Microsoft has reported that Office 2016 and Office 2019 for Mac properly prompt the user before executing XLM macros in SYLK files.

The Problem

If Office for the Mac has been configured to use the “Disable all macros without notification” feature, XLM macros in SYLK files are executed without prompting the user.

This issue is addressed for Office 2016 for Mac build 16.16.16 (19111100) and Office 2019 for Mac build 16.31 (19111002), as described in the Microsoft Security update for CVE-2019-1457.

SYLK files, which have the file extension SLK, should be blocked at email and web gateways to help prevent exploitation of this vulnerability.

References

Acknowledgements

This issue was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information