[CVE-2012-5858] [CVE-2012-5859] DoS/Authorization Bypass - Kies Air

[cjlacayo@xxxxxxxxx]

Name: [CVE-2012-5858] [CVE-2012-5859] DoS/Authorization Bypass - Kies Air
Package: com.samsung.swift.app.kiesair
Affected versions: 2.1.207051, 2.1.210161
Testing Device: Samsung S3 (AT&T) - SAMSUNG-SGH-I747
Android Version: 4.0.4/ Build Number: IMM76D.I747UCALH9
Vendor homepage: http://www.samsung.com/us/kiesair
Researcher: Claudio J. Lacayo


APPLICATION OVERVIEW
======================
Kies Air is a application that enables you to easily manage contents saved on 
your device via PC internet or mobile browser using Wi-Fi technology. Without 
having to connect any cables, within a browser you can use diverse function 
such as multimedia transfer, music listening, PIMS management, text message, 
file search, and so on.

VULNERABILITY SUMMARY
=======================
The default application behaviour of the Kies Air application was analyzed 
uncovering a local authorization bypass attack that allows a malicious attacker 
to obtain the full contents of the phone. Kies Air uses IP based authorization 
to allow access to the owners device via a web browser. The application has 
support for HTTPS but does not use it. Once a request is granted to an IP, an 
attacker can spoof the IP, de-authenticate the authorized client and assume the 
IP to retrieve content without alarming the user. It was also found that a 
specially crafted request can cause the application to crash at will. This DoS 
attack only requires the application to be running.

DETAILS
=======
Authorization Bypass:
A series of HTTP requests are made when the client connects to the Kies Air web 
server. The server responds with two 301 responses. The first 301 Moved 
Permanently response points to http://{TARGET_IP}:8080/www/index.html followed 
by another 301 pointing to a new URI location at: 
http://{TARGET_IP}:8080/www/index.gz.html - if the user is allowed access, the 
server responds with 200 OK otherwise a 401 Unauthorized response is returned.
Once the Kies Air web server is identified a de-authentication request can be 
sent to remove the authorized user on the network and obtain the authorized IP. 
Requesting access to Kies Air does not require the client to re-authenticate 
nor alert the mobile user that another connection attempt is being made.

Denial of Service:
Send GET request http://{TARGET_IP}:8080/www/apps/KiesAir/jws/ssd.php?E&;

ADVISORY TIMELINE
=================
10/16/2012 - Authorization bypass found and confirmed 
10/20/2012 - DoS found and confirmed
11/5/2012 - Vendor notified via email to Kies Air Support team.
11/6/2012 - Kies Air support team responds, requests vulnerability details to 
forward to Kies Air Development team. Whitepaper and code provided
11/10/2012 - Member from Mobile Security Team requests vulnerability disclosure 
extension. Due to severity and attack scope request denied and issue details 
published.
11/11/2012 - Advisory released.

CVSS 2.0 Base Metrics
==================
Reference Base Vector Base Score
CVSS Base Score
6.1
Impact Subscore
8.5
Exploitability Subscore
3.9
CVSS Temporal Score
5.3
CVSS Environmental Score
4.2
Modified Impact Subscore
6.7
Overall CVSS Score
4.2

RESOLUTION
===========
Upgrade the latest version of Kies Air to 2.2.211081 released November 8th, 
2012.

REFERENCES
============
Whitepaper: 
http://dl.dropbox.com/u/7779799/SamsungKiesAirAuthorizationBypassandDoS.pdf
PoC: https://github.com/cjlacayo/bash/blob/master/KiesAir/kiesauth.sh