bugtraq - PR08-24: Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 09 Oct 2008 14:02:44 +0100
From: ProCheckUp Research <research@...checkup.com>
To: bugtraq@...urityfocus.com
Subject: PR08-24: Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

PR08-24: Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection

Vulnerability found: 2 May 2008

Vendor informed: 2 May 2008, 1st August 2008

Vulnerability fixed: no response was received from the vendor. A
workaround has been included in the "Fix" section.

Advisory publicly released: 9th October 2008

Severity: High

Credits: Adrian Pastor of ProCheckUp Ltd (www.procheckup.com)

Description:

Attackers can inject a malicious HTML/JavaScript payload via the
"system.sysName.0" SNMP OID. Such payload is returned on the web
interface when the administrator user views pages such as
'/config/configure-systems.html'. The injected code can perform any
actions within the context of the current session (full administrative
rights).

Although usually the SNMP write community string must be guessed/cracked
for a SNMP injection [1] attack to work, some embedded devices come with
SNMP read/write access enabled by default. Some examples include many
ZyXEL Prestige router models [2] used in residential and SOHO networks,
and also products used in corporate and government environments such as
the Proxim Tsunami MP.11 2411 Wireless Point-to-Multipoint System.

- From Proxim Tsunami MP.11 2411's user manual:

"
SNMP Read/Write Community Password

The password for read and write access to the MP.11/MP.11a using SNMP.
Enter a password in both the Password field and the Confirm field. The
default password is public.
"

Successfully tested on:

Tsunami MP.11 2411 Wireless Point-to-Multipoint System
Wireless Router v- v1.0.0 Bld#24 SN-03AT15620395 v3.0.3

Note: make/model and firmware version were obtained via the
iso.org.dod.internet.mgmt.mib-2.system.sysDescr.0 SNMP OID.

Proof of concept:

$ snmpset -v1 -c public 192.168.1.100 sysName.0 s
'"><script>alert(1)</script>'

Fix:

Disable SNMP write access. If SNMP write access is absolutely needed,
change the default read/write community string from "public" to a
non-predictable and hard-to-crack value.

References:

[1] 	"SNMP Joins Dark Side in New XSS Attack"
	http://www.darkreading.com/document.asp?doc_id=147014

[2]	"ZyXEL Gateways Vulnerability Research" (See section 2.3 Persistent
XSS via SNMP)
	http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf

Tsunami MP.11 Model 2411 and Model 5054:
http://www.proxim.com/learn/library/datasheets/mp11_a4.pdf

ProCheckUp Security Vulnerabilities and Advisories:
http://www.procheckup.com/Vulnerabilities.php

Legal:

Copyright 2008 Procheckup Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the
Internet community for the purpose of alerting them to problems, if and
only if, the Bulletin is not edited
or changed in any way, is attributed to Procheckup, and provided such
reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. Procheckup is not
liable for any misuse  of this information by any third party.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFI7gD0oR/Hvsj3i8sRAoQiAKCd1XGmckAOP8Pttn4KKi1uarV7DwCfZxAA
6QdkwHCtSbR50tVD9w99x/U=
=XFN4
-----END PGP SIGNATURE-----