TeamSpeak Server Crypt::decodeBase64 information disclosure

Summaryinfo

A vulnerability was found in TeamSpeak Server. It has been rated as problematic. The impacted element is the function Crypt::decodeBase64. Performing a manipulation results in information disclosure. Moreover, an exploit is present.

Detailsinfo

A vulnerability, which was classified as problematic, was found in TeamSpeak Server (version unknown). This affects the function Crypt::decodeBase64. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality.

The weakness was disclosed 08/12/2016 by Hanz Jenson as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The vendor was not involved in the public release. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a private exploit are known. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK. The advisory points out:

When a client first connects to the server, it sends over an IV. The IV is base64-encoded. The server decodes it in VirtualServerBase::clientInitIV. However the server ignores the return value of Crypt::decodeBase64 which is the decoded length. Instead it assumes that the length is always 10 bytes. If the client only encodes e.g. 9 bytes and sends them over, one byte of the IV will be uninitialized. The client can guess this byte. Only a correct guess will prevent later cryptographic operations from failing. Thus the client can deduce the byte. It can repeat the process, sending over only 8 bytes, etc. This lets us do a byte-at-a-time leak from the stack.

It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-90866, VDB-90868, VDB-90869 and VDB-90870 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• TeamSpeak

Name

• Server

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion