Overview
Cisco Talos is disclosing several vulnerabilities identified in Circle with Disney. Circle with Disney is a network device designed to monitor the Internet use of children on a given network. Circle pairs wirelessly, with your home Wi-Fi and allows you to manage every device on the network, tablet, TV, or laptop. It can also pair via ethernet after the initial pairing. Using an iOS or Android app, families create unique profiles for every member of the home and from there, help shape each person's online experience.

The security team at Circle Media has been exemplary to work with from initial vulnerability discovery to release. They have been responsive and open to communication. Additionally, the Circle with Disney was designed such that software updates are pushed down to customer devices when they become available. Customers who have received these updates are protected against these vulnerabilities.

Through these exploitable vulnerabilities a malicious attacker could gain various levels of access and privilege, including the ability to alter network traffic, execute arbitrary remote code, inject commands , install unsigned firmware, accept a different certificate than intended, bypass authentication, escalate privileges, reboot the device, install a persistent backdoor, overwrite files, or even completely brick the device.

Details

TALOS-2017-0370 -- CVE-2017-2864
An exploitable vulnerability exists in the generation of authentication token functionality of Circle with Disney. Specially crafted network packets can cause a valid authentication token to be returned to the attacker resulting in authentication bypass. An attacker can send a series of packets to trigger this vulnerability.

TALOS-2017-0371 -- CVE-2017-2865
An exploitable vulnerability exists in the firmware update functionality of Circle with Disney. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability.

TALOS-2017-0372 -- CVE-2017-2866
An exploitable vulnerability exists in the /api/CONFIG/backup functionality of Circle with Disney. Specially crafted network packets can cause a os command injection. An attacker can send a http request trigger this vulnerability.

TALOS-2017-0388 -- CVE-2017-2881
An exploitable vulnerability exists in the torlist update functionality of Circle with Disney. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability.

TALOS-2017-0389 -- CVE-2017-2882
An exploitable vulnerability exists in the servers update functionality of Circle with Disney. Specially crafted network packets can cause the device to overwrite sensitive files, resulting in code execution. An attacker needs to impersonate a remote server in order to trigger this vulnerability.

TALOS-2017-0390 -- CVE-2017-2883
An exploitable vulnerability exists in the database update functionality of Circle with Disney. Specially crafted network packets can cause the device to execute arbitrary code. An attacker needs to impersonate a remote server in order to trigger this vulnerability.

TALOS-2017-0391 -- CVE-2017-2884
An exploitable vulnerability exists in the user photo update functionality of Circle with Disney. A repeated set of specially crafted API calls can cause the device to corrupt essential memory, resulting in an effectively bricked device. An attacker needs network connectivity to the device to trigger this vulnerability.

TALOS-2017-0396 -- CVE-2017-2889
An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney. A large amount of simultaneous TCP connections causes the APID daemon to repeatedly fork, causing the daemon to run out of memory and trigger a device reboot. An attacker needs network connectivity to the device to trigger this vulnerability.

TALOS-2017-0397 -- CVE-2017-2890
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability.

TALOS-2017-0405 -- CVE-2017-2898
An exploitable vulnerability exists in the signature verification of the firmware update functionality of Circle with Disney. Specially crafted network packets can cause an unsigned firmware to be installed in the device resulting in arbitrary code execution. An attacker can send a series of packets to trigger this vulnerability.

TALOS-2017-0418 -- CVE-2017-2911
An exploitable vulnerability exists in the rclient SSL validation in the remote control functionality of the Circle with Disney. Certificates for specific domain names can cause the product to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this vulnerability.

TALOS-2017-0419 -- CVE-2017-2912
An exploitable vulnerability exists in the goclient SSL validation in the remote control functionality of the Circle with Disney. SSL certificates for specific domain names can cause the product to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this vulnerability.

TALOS-2017-0420 -- CVE-2017-2913
An exploitable vulnerability exists in the libbluecoat.so SSL validation in the remote control functionality of the Circle with Disney. SSL certificates for specific domain names can cause the product to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this vulnerability.

TALOS-2017-0421 -- CVE-2017-2914
An exploitable authentication bypass vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A specially crafted token can bypass the authentication routine of the Apid binary, causing the device to grant unintended administrative access. An attacker needs network connectivity to the device to trigger this vulnerability.

TALOS-2017-0422 -- CVE-2017-2915
An exploitable vulnerability exists in the WiFi configuration functionality of Circle with Disney. A specially crafted SSID can cause the device to execute limited length shell commands, resulting in code execution. An attacker needs to send a couple of HTTP requests and setup an access point reachable by the device to trigger this vulnerability.

TALOS-2017-0423 -- CVE-2017-2916
An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney. Specially crafted network packets can cause an arbitrary file to be overwritten. An attacker can send an HTTP request trigger this vulnerability.

TALOS-2017-0424 -- CVE-2017-2917
An exploitable vulnerability exists in the notifications functionality of Circle with Disney. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability.

TALOS-2017-0435 -- CVE-2017-12083
An exploitable information disclosure vulnerability exists in the Circle with Disney Apid daemon. A specially crafted set of packet can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivity to the Internet to trigger this vulnerability.

TALOS-2017-0436 -- CVE-2017-12084
A backdoor vulnerability exists in remote control functionality of Circle with Disney. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker send an API call to enable the SSH server.

TALOS-2017-0437 -- CVE-2017-12085
An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet to any arbitrary Circle device. An attacker needs network connectivity to the Internet to trigger this vulnerability.

TALOS-2017-0446 -- CVE-2017-12094
An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney. A specially crafted SSID can cause the device to execute limited length sed commands. An attacker needs to setup an access point reachable by the device to trigger this vulnerability.

TALOS-2017-0447 -- CVE-2017-12095
An exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney running firmware 2.0.1. A series of WiFi packets can force Circle to setup an Access Point with default credentials. An attacker needs to send a series of spoofed "de-auth" packets to trigger this vulnerability.

TALOS-2017-0448 -- CVE-2017-12096
An exploitable vulnerability exists in the WiFi management of Circle with Disney. The Circle device will always connect to the configured Access Point SSID, even if the security option changes. An attacker needs to setup an Access Point reachable by the device and to send a series of spoofed "deauth" packets to trigger this vulnerability.

Coverage
The following Snort Rules will detect exploitation attempts of this vulnerability. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your FireSIGHT Management Center or Snort.org

Rules
43487-43488, 43712, 43714-43716, 43861, 43864, 44012, 44070, 44082, 44142, 44162, 44189, 44267-44268, 44297