Full Disclosure mailing list archives
Nikon CoolPix L Series Fw1.0 - Information Disclosure Issue
From: Vulnerability Lab <research () vulnerability-lab com>
Date: Tue, 16 Jul 2013 01:09:28 +0100
Title: ====== Nikon CoolPix L Series Fw1.0 - Information Disclosure Issue References: =========== http://www.vulnerability-lab.com/get_content.php?id=1014 Introduction: ============= Attractive, sturdy and easy to use, the 16-megapixel COOLPIX L27 & 25 is clever with images—so you don’t have to be. Simple controls and smart automatic technology deliver steady images and ensure you capture portraits with smiling faces and open eyes, through the NIKKOR wide-angle 5x optical zoom lens. A large 6.7-cm (2.7-in.) LCD screen displays images with superb clarity at any time of day or night and you can switch to filming the action at the touch of a button, or set the camera to Easy Auto mode and capture photos without worrying about a thing. (Copy of the Vendor Homepage: http://www.europe-nikon.com/en_GB/product/digital-cameras/coolpix/life/coolpix-l27 ) Abstract: ========= The Vulnerability Laboratory Research Team discovered a information disclosure issue in the Nikon CoolPix Digital Camera L25 with Firmware 1.0. Report-Timeline: ================ 2013-07-16: Public Disclosure (Vulnerability Laboratory) Status: ======== Published Affected Products: ================== Nikon Product: COOLPIX L25 L27 & L28 Exploitation-Technique: ======================= Hardware Severity: ========= Medium Details: ======== An information disclosure issue is detected in the official Nikons Camera L Series 25, 28 & maybe others. The information disclosure bug allows remote attackers to access sensitive information of other people, websites, servers or companies. The privacy issue is located in the menu > system module when processing to save a start bild (start picture) when processing to boot the camera system. The camera allows to save a start bild (start picture) and does not remove it when processing to perform a format or firmware reset. People can access the device to watch in the short review of the start bild (start picture) the earlier deleted pictures. The device does not recognize it and stored the pictures without the possibility to delete. In a scenario on eBay we bought from a private seller a nikon camera. He uses the camera about 2 years for his holiday trips and conferences. He recognized in a mail the camera got a format and firmware reset. When the camera arrived at our location we was watching the into short review of the start bild (start picture) and saw several images of the owner. Proof of Concept: ================= The information disclosure issue can be reproduced by local attackers with physical camera device access. Steps to reproduce ... 1. Start the Nikon L series camera 2. Go in the camera screen mode and take a nice picture 3. Go to System > Start Bild 4. Choose your own picture and save it as start picture 5. Now shutdown the camera the regular way and start it again after some secounds 6. The image of us will be visible when the system boots 7. When go to the Menu go to System and format the device 8. Go to Menu again and switch to System 9. After the format we now reset the device 10. Shutdown the Nikon Camera and take out the sd card of course 11. Restart it and go to the menu, open the start bild (start picture) module 12. Now the image of us is visible even but we did a full hardware reset or format 13. Information Disclosure issue in Nikon L Series successful reproduced! Note: When the image is saved in the camera as start picture, no format & no firmware reset can remove it anymore. Solution: ========= To fix the vulnerability remove with the firmware reset or format all pictures from the review menu. Credits: ======== Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm () evolution-sec com) -- VULNERABILITY LABORATORY RESEARCH TEAM DOMAIN: www.vulnerability-lab.com CONTACT: research () vulnerability-lab com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Nikon CoolPix L Series Fw1.0 - Information Disclosure Issue Vulnerability Lab (Jul 15)