Alcatel Speed Touch ADSL Insecure Administration Interface Vulnerability
BID:2568
Info
Alcatel Speed Touch ADSL Insecure Administration Interface Vulnerability
| Bugtraq ID: | 2568 |
| Class: | Design Error |
| CVE: |
CVE-2001-1424 CVE-2001-1425 CVE-2001-1426 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 10 2001 12:00AM |
| Updated: | Jul 11 2009 06:06AM |
| Credit: | Discovered by Tsutomu Shimomura. Reported to bugtraq by Tom Perrine <[email protected]> on 10 Apr 2001 |
| Vulnerable: |
Alcatel Speed Touch Home KHDSAA.134 Alcatel Speed Touch Home KHDSAA.133 Alcatel Speed Touch Home KHDSAA.132 Alcatel Speed Touch Home KHDSAA.108 |
| Not Vulnerable: | |
Discussion
Alcatel Speed Touch ADSL Insecure Administration Interface Vulnerability
In the factory shipped state, no password is set for the device's administration interface. This could permit a user to reconfigure the unit, or set the password and prevent the device from being reconfigured.
Once a password has been set, the device remains vulnerable to attack in two ways.
- TFTP: The device's TFTP service can be used to overwrite configuration files. This approach may allow an attacker to set or modify the administration password even if it has been previously set.
- Cryptographic attack: by connecting to the "EXPERT" account, a challenge-response sequence is initiated which
is reportedly vulnerable to cryptographic attack. Details of the challenge-response algorithm were not made publicly available.
The device's configuration settings are accessible through FTP, HTTP and Telnet interfaces. In addition, the device's file structure is exposed through FTP. All of these services allow the modification of configuration information.
By default, no password is set for any of these services, so no authentication is required for access.
*** NOTE: Shortly after this advisory was published, the vendor, Alcatel, posted their response to the reported vulnerabilities in their modems.
In addition to providing general mitigating strategies designed to lessen the impact of these isses (such as firewall software and/or a dedicated firewall device or the Alcatel Speed Touch modem with Firewall capabilities), the vendor response indicates that only the Speed Touch Pro is vulnerable to remote changes to firmware code and configuration settings, and that this model can be made secure from such interference by the activation of an inbuilt security feature disabling remote access from the WAN/DSL interface. Therefore, while the discoverer's initial advisory states that the entire family of devices may be vulnerable, the vendor limits the scope of this vulnerability to a single, misconfigured model of the Speed Touch line.
This discussion will be updated regularly as further details and clarification emerge.
In the factory shipped state, no password is set for the device's administration interface. This could permit a user to reconfigure the unit, or set the password and prevent the device from being reconfigured.
Once a password has been set, the device remains vulnerable to attack in two ways.
- TFTP: The device's TFTP service can be used to overwrite configuration files. This approach may allow an attacker to set or modify the administration password even if it has been previously set.
- Cryptographic attack: by connecting to the "EXPERT" account, a challenge-response sequence is initiated which
is reportedly vulnerable to cryptographic attack. Details of the challenge-response algorithm were not made publicly available.
The device's configuration settings are accessible through FTP, HTTP and Telnet interfaces. In addition, the device's file structure is exposed through FTP. All of these services allow the modification of configuration information.
By default, no password is set for any of these services, so no authentication is required for access.
*** NOTE: Shortly after this advisory was published, the vendor, Alcatel, posted their response to the reported vulnerabilities in their modems.
In addition to providing general mitigating strategies designed to lessen the impact of these isses (such as firewall software and/or a dedicated firewall device or the Alcatel Speed Touch modem with Firewall capabilities), the vendor response indicates that only the Speed Touch Pro is vulnerable to remote changes to firmware code and configuration settings, and that this model can be made secure from such interference by the activation of an inbuilt security feature disabling remote access from the WAN/DSL interface. Therefore, while the discoverer's initial advisory states that the entire family of devices may be vulnerable, the vendor limits the scope of this vulnerability to a single, misconfigured model of the Speed Touch line.
This discussion will be updated regularly as further details and clarification emerge.
Solution / Fix
Alcatel Speed Touch ADSL Insecure Administration Interface Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.