VDB-13428 · CVE-2014-125001 · GCVE-100-13428

Cardo Systems Scala Rider Q3 Cardo-Updater /cardo/api 权限提升

摘要信息

在Cardo Systems Scala Rider Q3中曾发现分类为棘手的漏洞。受此漏洞影响的是未知功能文件：/cardo/api的组件Cardo-Updater。在被操纵的情况下，会引发权限提升。该安全漏洞被称为CVE-2014-125001。不存在可用的漏洞利用。建议采用限制性防火墙。

在Cardo Systems Scala Rider Q3中曾发现分类为棘手的漏洞。受此漏洞影响的是未知功能文件：/cardo/api的组件Cardo-Updater。在被操纵的情况下，会引发权限提升。通过 CWE 声明此问题将指向 CWE-269。此漏洞的脆弱性 2014-06-03由公示人Max Moser、公示人所属公司modzero AG、公示人身份Ride With The Devil、公示人类型为Blog Post (网站)所披露。您可以在 remote-exploit.org 下载该通告。此次公开发布未经供应商参与。披露如下内容：

The vendor has been informed about this blogpost and the software is removed from my systems. Everyone with the cardo-updater installed should do the same.

该安全漏洞被称为CVE-2014-125001。技术细节已提供。此漏洞的流行程度低于一般水平。不存在可用的漏洞利用。当前，大致为 USD $0-$5k。 MITRE ATT&CK 项目将攻击技术声明为 T1068。公告内容如下：

During the installation, I was informed by my application monitor Hands Off) wants to bind itself to TCP port 8080. Wait a minute. Wtf ... listening on port 8080? After further investigation, I recognised that the binary is installed as a LaunchAgent and thus the application is executed as root. Just to make this clear - I just installed a service running as root and listening on port 8080 on every interface of my computer -- what could possibly go wrong? (…) Depending on what setting you change on the Cardo website, a corresponding request will be constructed and executed.