LG LR Series WAN Router Data Stream Denial Of Service Vulnerability

Bugtraq ID:	5532
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Aug 21 2002 12:00AM
Updated:	Aug 21 2002 12:00AM
Credit:	Vulnerability discovery credited to Lukasz Bromirski <[email protected]>.
Vulnerable:	LG LR3100p 1.50 LG LR3100p 1.30 LG LR3001f 4.0
Not Vulnerable:	LG LR3001f 4.57

LG LR Series WAN Router Data Stream Denial Of Service Vulnerability

The LR series WAN routers are hardware and firmware solutions manufactured and distributed by LG Electronics.

It has been discovered that when a stream of data is sent to the router on certain ports, the router becomes unstable. By sending a stream of data to port 23/TCP (and also port 80/TCP on some models), which is accessible by default, the router reacts unpredictably. This type of attack typically results in a crash of the router.

It has been theorized that this issue is a bug in the TCP/IP stack of the device, and possibly an exploitable buffer overflow.

LG LR Series WAN Router Data Stream Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

LG LR Series WAN Router Data Stream Denial Of Service Vulnerability

References: