[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Nikon CoolPix L Series Fw1.0 - Information Disclosure Issue

Title:
======
Nikon CoolPix L Series Fw1.0 - Information Disclosure Issue


Date:
=====
2013-07-16


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=1014


VL-ID:
=====
1014


Common Vulnerability Scoring System:
====================================
3.5


Introduction:
=============
Attractive, sturdy and easy to use, the 16-megapixel COOLPIX L27 & 25 is clever 
with images—so you don’t have to be. 
Simple controls and smart automatic technology deliver steady images and ensure 
you capture portraits with smiling 
faces and open eyes, through the NIKKOR wide-angle 5x optical zoom lens.

A large 6.7-cm (2.7-in.) LCD screen displays images with superb clarity at any 
time of day or night and you can 
switch to filming the action at the touch of a button, or set the camera to 
Easy Auto mode and capture photos 
without worrying about a thing.

(Copy of the Vendor Homepage: 
http://www.europe-nikon.com/en_GB/product/digital-cameras/coolpix/life/coolpix-l27
 )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered a information disclosure 
issue in the Nikon CoolPix Digital Camera L25 with Firmware 1.0.


Report-Timeline:
================
2013-07-16:    Public Disclosure (Vulnerability Laboratory)


Status:
========
Published


Affected Products:
==================
Nikon
Product: COOLPIX L25 L27 & L28


Exploitation-Technique:
=======================
Hardware


Severity:
=========
Medium


Details:
========
An information disclosure issue is detected in the official Nikons Camera L 
Series 25, 28 & maybe others.
The information disclosure bug allows remote attackers to access sensitive 
information of other people, websites, servers or companies.

The privacy issue is located in the menu > system module when processing to 
save a start bild (start picture) when processing to boot 
the camera system. The camera allows to save a start bild (start picture) and 
does not remove it when processing to perform a format or 
firmware reset. People can access the device to watch in the short review of 
the start bild (start picture) the earlier deleted pictures. 
The device does not recognize it and stored the pictures without the 
possibility to delete.

In a scenario on eBay we bought from a private seller a nikon camera. He uses 
the camera about 2 years for his holiday trips and conferences.
He recognized in a mail the camera got a format and firmware reset. When the 
camera arrived at our location we was watching the into short 
review of the start bild (start picture) and saw several images of the owner.


Proof of Concept:
=================
The information disclosure issue can be reproduced by local attackers with 
physical camera device access.

Steps to reproduce ...

1.   Start the Nikon L series camera
2.   Go in the camera screen mode and take a nice picture
3.   Go to System > Start Bild
4.   Choose your own picture and save it as start picture
5.   Now shutdown the camera the regular way and start it again after some 
secounds
6.   The image of us will be visible when the system boots
7.   When go to the Menu go to System and format the device
8.   Go to Menu again and switch to System
9.   After the format we now reset the device
10. Shutdown the Nikon Camera and take out the sd card of course
11. Restart it and go to the menu, open the start bild (start picture) module
12. Now the image of us is visible even but we did  a full hardware reset or 
format
13. Information Disclosure issue in Nikon L Series successful reproduced!

Note:
When the image is saved in the camera as start picture, no format & no firmware 
reset can remove it anymore.


Solution:
=========
To fix the vulnerability remove with the firmware reset or format all pictures 
from the review menu.


Risk:
=====
The security risk of the information disclosure issue is estimated as medium(-).


Credits:
========
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri 
(bkm@xxxxxxxxxxxxxxxxx)


Disclaimer:
===========
The information provided in this advisory is provided as it is without any 
warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and 
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, 
indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have 
been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential 
or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor 
licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com              
               - www.vulnerability-lab.com/register
Contact:    admin@xxxxxxxxxxxxxxxxxxxxx         - support@xxxxxxxxxxxxxxxxxxxxx 
               - research@xxxxxxxxxxxxxxxxxxxxx
Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com   
               - news.vulnerability-lab.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab 
               - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - 
vulnerability-lab.com/rss/rss_upcoming.php   - 
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file 
requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is 
granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All 
pictures, texts, advisories, source code, videos and 
other information on this website is trademark of vulnerability-lab team & the 
specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or 
support@xxxxxxxxxxxxxxxxxxxxx) to get a permission.

                                        Copyright © 2013 | Vulnerability 
Laboratory



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx