Multiple vulnerabilities in Barco Clickshare

[<vincent.ruijter@xxxxxxx>]

CVE-2016-3149 - Remote Code Execution in Barco ClickShare CSC-1 and CSM-1
Affected versions: all versions prior to v01.09.03 (CSC-1) and v01.06.02 
(CSM-1).
A remote code execution vulnerability exists within the Barco ClickShare base 
unit software, that could lead to full compromise of the appliance.

CVE-2016-3150 - Cross-site Scripting in Barco ClickShare CSC-1, CSM-1 and 
CSE-200
Affected versions:  all versions prior to v01.09.03 (CSC-1), v01.06.02 (CSM-1) 
and v01.03.02 (CSE-200)
A Cross-Site Scripting vulnerability exists within Barco ClickShare's CSC-1 
base unit's wallpaper.php due to invalid input and output sanitisation. 

CVE-2016-3151 - Path Traversal in Barco ClickShare CSC-1, CSM-1 and CSE-200
Affected versions: all versions prior to v01.09.03 (CSC-1),  v01.06.02 (CSM-1) 
and v01.03.02 (CSE-200).
A Path Traversal vulnerability exists within Barco ClickShare's wallpaper 
parsing functionality, which leads to disclosure of the /etc/shadow file on the 
file system. 

CVE-2016-3152 - /etc/shadow file disclosure in the CSC-1 firmware update
Affected versions: all versions prior to v01.09.03 (CSC-1)
It is possible to download and extract the firmware image of the CSC-1 and 
obtain the root password.

The vendor has acknowledged and patched the aforementioned issues. It is 
recommended to download and apply the most recent firmware update for your 
appliance.

References:
http://www.barco.com/en/mybarco/mysupport/documentation/software/software-detail?nr=R33050020&rev=001002000009
http://www.barco.com/en/mybarco/mysupport/productsupport/software/software-detail?nr=R33050037&rev=001001000113
https://www.barco.com/en/mybarco/mysupport/productsupport/software/software-detail?nr=R33050070&rev=001001000008

--

Regards,

Vincent Ruijter
Ethical Hacker
Chief Information Security Office
KPN B.V.