Vulnerability Note VU#213486

LifeSize Room appliance authentication bypass and arbitrary code injection vulnerability

Overview

LifeSize Room appliance contains an authentication bypass and arbitrary code injection vulnerability when failing to sanitize input from unauthenticated clients.

I. Description

According to LifeSize’s website “LifeSize Room combines an immersive, high definition video experience with a rich set of features to deliver a powerful, flexible, and easy-to-use video communication solution.”

The LifeSize Room appliance contains an embedded web interface that allows administrative access to the appliance. This web interface fails to sanitize input from unauthenticated clients leading to an authentication bypass and possibly arbitrary code injection.

Using a proxy tool to intercept traffic between the attacker and the LifeSize Room appliance web interface, an unauthenticated attacker makes a request to the gateway.php web page that references the LSRoom_Remoting.authenticate function. The attacker can modify the Action Message Format (AMF) data in the response from the server, changing the value from “false” to “true” allowing the attacker to bypass the appliance web interface authentication.

An additional vulnerability exists when an unauthenticated attacker makes a request to the gateway.php web page that references the LSRoom_Remoting.doCommand function. Using a proxy tool to intercept traffic between the attacker and the LifeSize Room appliance system web interface, the attacker can modify the AMF data in the original parameter “pref -l /var/system/upgrade/status” in the vulnerable LSRoom_Remoting.doCommand function to be an arbitrary command that will run with the permission of the webserver.

According to the vulnerability reporter LifeSize Room LS_RM1_3.5.3 (11) and 4.7.18 is vulnerable, and possibly other versions.

II. Impact

A remote, unauthenticated attacker can bypass the authentication of the administrative web interface and possibly inject arbitrary code in the administrative system web interface.

III. Solution

We are currently unaware of a practical solution to this problem.

Restrict network access

Restrict network access to the LifeSize Room appliance administrative interface and other devices using open protocols like HTTP.

Vendor Information

Vendor	Status	Date Notified	Date Updated
Logitech	Affected	2011-07-21	2011-08-26

References

http://www.securestate.com/Documents/LifeSize_Room_Advisory.txt

Credit

Thanks to Spencer McIntyre of SecureState for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

Date Public:	2011-08-29
Date First Published:	2011-08-29
Date Last Updated:	2011-08-29
CERT Advisory:
CVE-ID(s):	CVE-2011-2762 CVE-2011-2763
NVD-ID(s):	CVE-2011-2762 CVE-2011-2763
US-CERT Technical Alerts:
Severity Metric:	1.36
Document Revision:	16

The original article/video can be found at VU#213486: LifeSize Room appliance authentication bypass and arbitrary code injection vulnerability