bugtraq - DLINK 624, script injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <40E3E950.50308@sympatico.ca>
Date: Thu, 01 Jul 2004 03:37:04 -0700
From: Gregory Duchemin <c3rb3r@...patico.ca>
To: bugtraq@...urityfocus.com
Subject: DLINK 624, script injection vulnerability

TITLE: Security flaw in DLINK 624 - SOHO routers (http://www.dlink.com)

TYPE: Script injection over DHCP

QUOTE from DLINK:

The D-Link Xtreme G DI-624 wireless router with 108Mbps^*  upgrade 
employs five cutting-edge hardware-based compression technologies to achieve a 
significant boost in performance within the 2.4GHz frequency range. 
...
The D-Link 802.11g DI-624 Xtreme G features robust security to protect the 
wireless network from intruders, complying with the latest wireless networking 
security protocols, including WEP encryption and Wi-Fi Protected Access (WPA) 
support for both 802.1x and WPA-PSK. The DI-624 is also capable of supporting 
the government-grade AES encryption and upcoming 802.11i standards.

DETAILS:

The DI-624 SOHO router (Revision B, latest firmware rev 1.28) suffers a "script
injection over dhcp" vulnerability.
Using DHCP as a vector, arbitrary and malicious scripting can be
injected into the DHCP administrative and logs pages (if enabled)

Scripting sent in such a way will be executed on behalf of the unaware
administrator next time he consult the web based management interface and
lead to the complete compromising of the
firewall/router giving full access to the administrative account.

Like the DI-614+, DLINK's DI-624 model does not filter user supplied data passed through the DHCP
HOSTNAME option.
Basically, it first truncates the string to 20 characters and displays it AS IS 
in the DHCP and log pages (if logs are enabled) opening a large hole that can easily be exploited for instance:

to change the administrator's password (doesn't require his current password)
to reboot the box 
to reset the box's factory settings (blank admin password/no wep)

Because the DLINK 624 is used, among others, by coffee shops,  a
successful exploitation may have very serious impact.

EXPLOITATION:

Exact same procedure as described for the DI-614+ and available at:
http://securityfocus.com/archive/1/366615/2004-06-21/2004-06-27/0

VENDOR:

DLINK's support staff has been contacted on May 24th for this very same issue
affecting their DI-614+ but has yet to reply and confirm if they plan to fix it in the
upcoming firmwares.

WORKAROUND:
Use static leasing only (it fixes the hostname) otherwise just use a
real dhcpd daemon (and disable DLINK dhcpd)

VULNERABLE:

DI-624 Revision B, firmware up to 1.28 (latest)
It is *highly* probable that other models are affected too.

AUTHOR: Gregory Duchemin (c3rb3r at sympatico.ca)

THANKS: To Francois Beaupres who let me mess with his baby