| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 19 Feb 2008 23:30:46 +0000 From: ProCheckUp Research <research@...checkup.com> To: full-disclosure@...ts.grok.org.uk Subject: ZyXEL Gateways Vulnerability Research: http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf This paper is the result of various security assessments performed on several ZyXEL Prestige devices in both, a controlled environment (computer lab) and production environments during several penetration tests. There are two types of attacks featured in this paper which we believe might be potentially new: - Persistent XSS via SNMP - Remote wardriving over the Internet Additionally, the paper is full of other goodies such as: - Privilege escalation: it allows retrieving administrative settings (i.e.: WEP key, ISP and dynamic DNS credentials) and also altering such settings - SNMP read and SNMP *write* access enabled by default: not only we demonstrate how to change settings but we also show how to obtain the credentials for the Dynamic DNS service in cleartext - Poor session management allows hijacking of admin sessions - Authentication vulnerable to replay and password cracking attacks - Disclosure of credentials: several types of credentials travel in the clear when being submitted by the user, and also when being returned from the web interface back to the browser http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists