ContentKeeper Web RCE and Privilege Escalation Vulnerability

Critical Vulnerability Information Release Date: April 3, 2009 Affected Software: ContentKeeper Technologies - ContentKeeper Web (versions 125.09 and earlier) Vulnerability Type: Remote Command Execution and Privilege Escalation Vulnerability Impact: - Unauthenticated users can remotely execute commands via the device's management IP address, running as the Apache user. - A privilege escalation vulnerability exists, allowing unauthenticated users to gain root privileges remotely. Vulnerability Details The device is managed via a web browser-based HTML frontend. The .htaccess file blocks unauthenticated access to known HTML management pages, but other binary files (such as mimencode) are exposed. By sending an HTTP POST request, arbitrary data can be written to a default file with world-readable, writable, and executable permissions. Sending an HTTP GET request to the written file allows remote execution of arbitrary commands. The mimencode utility can be exploited for directory traversal attacks, such as retrieving a MIME-encoded copy of /etc/passwd. A setuid root binary (benetool) available to the Apache user contains unsafe calls to commands like 'ps', enabling privilege escalation via PATH manipulation. Solution Upgrade to version 125.10 or later. References aushack.com advisory: http://www.aushack.com/200904-contentkeeper.txt Acknowledgments Patrick Webster (patrick@aushack.com) Disclosure Timeline April 10, 2008 - Discovered during audit. July 18, 2008 - Vendor notified. July 18, 2008 - Vendor responded. February 18, 2009 - Vendor confirmed patched version. April 3, 2009 - Public disclosure.

Goal Reached Thanks to every supporter — we hit 100%!

ContentKeeper Web RCE and Privilege Escalation Vulnerability