D-Link DWL-1000AP Wireless LAN Access Point Plaintext Password Vulnerability
BID:3735
Info
D-Link DWL-1000AP Wireless LAN Access Point Plaintext Password Vulnerability
| Bugtraq ID: | 3735 |
| Class: | Design Error |
| CVE: |
CVE-2001-1220 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 21 2001 12:00AM |
| Updated: | Jul 11 2009 09:06AM |
| Credit: | This vulnerability was submitted to BugTraq on December 21st, 2001 by Jonathan Strine <[email protected]>. |
| Vulnerable: |
D-Link DWL-1000AP Firmware 3.2.28 #483 |
| Not Vulnerable: | |
Discussion
D-Link DWL-1000AP Wireless LAN Access Point Plaintext Password Vulnerability
DLink DWL-1000AP is a 11Mbps wireless LAN access point product, which is geared towards home users. It supports WEP, MAC address control and user authentication.
An oversight in the design of this product creates a vulnerability which may be exploited by an attacker to hijack the access point.
The administrative password is stored in plaintext in the default "public" MIB. Any attacker within range, using a SNMP client, can reveal the administrative password by browsing the "public" MIB.
With the administrative password, it is possible for an attacker to gain access to the wireless network, change the configuration of the device, or cause a denial of service.
The issue is further complicated by BugTraq ID 3736, "D-Link DWL-1000AP Wireless LAN Access Point Public Community String Vulnerability".
This issue has been confirmed with the 3.2.28 #483 (Aug 23
2001) firmware. Other versions of the firmware may also be affected.
DLink DWL-1000AP is a 11Mbps wireless LAN access point product, which is geared towards home users. It supports WEP, MAC address control and user authentication.
An oversight in the design of this product creates a vulnerability which may be exploited by an attacker to hijack the access point.
The administrative password is stored in plaintext in the default "public" MIB. Any attacker within range, using a SNMP client, can reveal the administrative password by browsing the "public" MIB.
With the administrative password, it is possible for an attacker to gain access to the wireless network, change the configuration of the device, or cause a denial of service.
The issue is further complicated by BugTraq ID 3736, "D-Link DWL-1000AP Wireless LAN Access Point Public Community String Vulnerability".
This issue has been confirmed with the 3.2.28 #483 (Aug 23
2001) firmware. Other versions of the firmware may also be affected.
Exploit / POC
D-Link DWL-1000AP Wireless LAN Access Point Plaintext Password Vulnerability
There issue may be exploited with a SNMP client.
There issue may be exploited with a SNMP client.
Solution / Fix
D-Link DWL-1000AP Wireless LAN Access Point Plaintext Password Vulnerability
Solution:
The vendor has released a firmware upgrade which addresses SNMP security issues. Symantec has not received confirmation from the vendor that this issue is specifically addressed by the upgrade.
The firmware upgrade is available at the following location:
http://tsd.dlink.com.tw/info.nsf/2eca71a2a969a08e48256adf002b4b61/2471fa3d2572857048256b50001e0709?OpenDocument
D-Link DWL-1000AP Firmware 3.2.28 #483
Solution:
The vendor has released a firmware upgrade which addresses SNMP security issues. Symantec has not received confirmation from the vendor that this issue is specifically addressed by the upgrade.
The firmware upgrade is available at the following location:
http://tsd.dlink.com.tw/info.nsf/2eca71a2a969a08e48256adf002b4b61/2471fa3d2572857048256b50001e0709?OpenDocument
D-Link DWL-1000AP Firmware 3.2.28 #483
References
D-Link DWL-1000AP Wireless LAN Access Point Plaintext Password Vulnerability
References:
References: