U.S. Robotics USR808054 Wireless Access Point Web Administration Denial Of Service Vulnerability
BID:10840
Info
U.S. Robotics USR808054 Wireless Access Point Web Administration Denial Of Service Vulnerability
| Bugtraq ID: | 10840 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 02 2004 12:00AM |
| Updated: | Aug 02 2004 12:00AM |
| Credit: | Albert Puigsech Galicia <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
U.S.Robotics USR808054 1.21 h |
| Not Vulnerable: | |
Discussion
U.S. Robotics USR808054 Wireless Access Point Web Administration Denial Of Service Vulnerability
The USR808054 wireless access point is reported to contain a denial of service vulnerability in its embedded web server.
When malicious requests are received by the device, it will reportedly crash, denying service to legitimate users of the access point.
This issue can be exploited by anybody with network connectivity to the administration HTTP server, no authentication is required.
Version 1.21h of the device was found to be vulnerable, but other versions are also likely affected. Due to the practice of code-reuse in companies, it is also possible that other devices and products have this same flaw.
This BID may also be related to BID 6994, but this has not been confirmed.
The USR808054 wireless access point is reported to contain a denial of service vulnerability in its embedded web server.
When malicious requests are received by the device, it will reportedly crash, denying service to legitimate users of the access point.
This issue can be exploited by anybody with network connectivity to the administration HTTP server, no authentication is required.
Version 1.21h of the device was found to be vulnerable, but other versions are also likely affected. Due to the practice of code-reuse in companies, it is also possible that other devices and products have this same flaw.
This BID may also be related to BID 6994, but this has not been confirmed.
Exploit / POC
U.S. Robotics USR808054 Wireless Access Point Web Administration Denial Of Service Vulnerability
No exploit is required. An example request was provided:
perl -e '$a = "GET / " . "A"x250 . "\r\n\r\n" ; print $a' | nc ap 80
No exploit is required. An example request was provided:
perl -e '$a = "GET / " . "A"x250 . "\r\n\r\n" ; print $a' | nc ap 80
Solution / Fix
U.S. Robotics USR808054 Wireless Access Point Web Administration Denial Of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
U.S. Robotics USR808054 Wireless Access Point Web Administration Denial Of Service Vulnerability
References:
References:
- USR808054 Product Home Page (U.S.Robotics)
- 7a69Adv#13 - USRobotics AP Wireless Denial of Service (Albert Puigsech Galicia