Red-M 1050AP LAN Access Point PPP Denial of Service Vulnerability

Bugtraq ID:	4943
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-0398
Remote:	Yes
Local:	No
Published:	Jun 05 2002 12:00AM
Updated:	Jul 11 2009 01:56PM
Credit:	Discovered by Ollie Whitehouse <[email protected]>.
Vulnerable:	Red-M 1050AP LAN access point
Not Vulnerable:

Red-M 1050AP LAN Access Point PPP Denial of Service Vulnerability

The Red-M 1050AP Lan Access Point is a hardware device which provides a
LAN access point to Bluetooth devices. The device supports a web based
administration interface.

Upon making a PPP connection to the Access Point, supplying an unusually long string of data in the PPP username field may initiate a denial of service condition. As a result, any new connection attempts will result in an 'Unable to establish a connection' error message.

Red-M 1050AP LAN Access Point PPP Denial of Service Vulnerability

No exploit code required.

Red-M 1050AP LAN Access Point PPP Denial of Service Vulnerability

Solution:
Red-M has addressed this issue in firmware v2.02.10:


Red-M 1050AP LAN access point

• Red-M 1050AP_2_02_10
  Firmware Upgrade
  http://www.red-m.com/Products/Downloads/freefiles/1050AP_2_02_10.zip

Red-M 1050AP LAN Access Point PPP Denial of Service Vulnerability

References:

• Red-M 1050AP access point (Red-M)