Title: MiniDVBLinux 5.4 Unauthenticated Stream Disclosure Vulnerability
Advisory ID: ZSL-2022-5716
Type: Local/Remote
Impact: Exposure of Sensitive Information
Risk: (3/5)
Release Date: 16.10.2022

Summary

MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple way to convert a standard PC into a Multi Media Centre based on the Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this Linux based Digital Video Recorder: Watch TV, Timer controlled recordings, Time Shift, DVD and MP3 Replay, Setup and configuration via browser, and a lot more. MLD strives to be as small as possible, modular, simple. It supports numerous hardware platforms, like classic desktops in 32/64bit and also various low power ARM systems.

Description

The application suffers from an unauthenticated live stream disclosure when /tpl/tv_action.sh is called and generates a snapshot in /var/www/images/tv.jpg through the Simple VDR Protocol (SVDRP).

Vendor

MiniDVBLinux - https://www.minidvblinux.de

Affected Version

<=5.4

Tested On

MiniDVBLinux 5.4
BusyBox v1.25.1
Architecture: armhf, armhf-rpi2
GNU/Linux 4.19.127.203 (armv7l)
VideoDiskRecorder 2.4.6

Vendor Status

[24.09.2022] Vulnerability discovered.
[27.09.2022] Vendor contacted.
[15.10.2022] No response from the vendor.
[16.10.2022] Public security advisory released.

PoC

mldhd_stream.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] https://packetstormsecurity.com/files/168739/
[2] https://cxsecurity.com/issue/WLB-2022100045
[3] https://www.exploit-db.com/exploits/51095

Changelog

[16.10.2022] - Initial release
[04.12.2022] - Added reference [1] and [2]
[10.04.2023] - Added reference [3]

Contact

Zero Science Lab

Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk