Audi A7 2014 MMI Mishandles the Format-string Specifiers

Date: 2020-10-13

Author: Kevin2600

CVE: CVE-2020-27524

Version:  Audi A7 2014 MMI

Vendor: https://www.audi.com/en.html

Attack-Vector: 

There is an improper format strings specifiers handling bug on Audi A7 2014 MMI Infotainment system. Simply rename the Mobile's Bluetooth name to "%x%x%x%x%x" or other specifiers. It will cause MMI memory leaks or even crash the service. 

Reproduce-Steps:

1) Rename Phone's Bluetooth name to "%x%x%x%x%x" 

2) Connect to the Audi's MMI IVI as normal through Bluetooth connection. 

3) Start the Multimedia player and listen to music. In general, the Music source name will appear as normal. 

But if we set the name as format string specifiers. The Music source name will be leaking memory content instead. And some specifiers will even crash the services.

Vendor response:

The Vendor Audi has been contacted on Oct 14th, but they replied this issue does not concern them. Indeed, the bug alone doesn't seem to anything useful yet, but since CVE-2017-9212 BMW 330i 2011 and CVE-2020-16142 Mercedes-Benz AMG they all have such issue. Maybe we can start testing those German vehicles. You never know ;)

Solstice-Pod - Critical Unauthenticated Remote DoS Vulnerability

Date: 2020-09-30 

Author: Kevin2600

CVE: CVE-2020-27523

Version: Gen2i-Pod (5.0.2)

Vendor:

https://documentation.mersive.com/content/home.htm

https://documentation.mersive.com/content/topics/general-gen2i-pod-specs.htm

Attack-Vector:

When users try to connect to the Solstice-Pod, the correct screen key is needed in order to authenticate the user. Even appears to be only digit number can be accepted for the screen key. But we can still inject format-string specifiers like “%x”, And this will cause Solstice-Pod to reboot, which lead to a DoS attack.

Reproduce-Steps:

1: Connect to Solstice-Pod with browser for screen sharing. It asks to input the screen key.

2: Using BurpSuite to intercept the access URL path and replace the screen key value with format-string specifiers like “%x”. 

3: The Solstices-Pod will be reboot immediately, Screen went blank and restart takes about 20-30 seconds. 

Impact-Level:

According to Search engine ZoomEye, Shodan, and FoFa. Currently, more than 17,117 Solstice-pods exposed to the public on the Internet. And because this is an Unauthenticated Remote DoS Vulnerability, the impact is critical. 

Vendor response:

1) The Vendor Mersive has been contacted on SEPT 28th

2) The full detail and video demo have been sent based on Mersive requested on OCT 8th

3) Mersive replied on OCT 15th, their Dev team is currently investigating the bug. They are able to confirm and generate a fix for this. It will be in the 5.2 release.