bugtraq - Zyxel / Netgear and probably other routers leaking information.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050131133156.24400.qmail@www.securityfocus.com>
Date: 31 Jan 2005 13:31:56 -0000
From: Jens Kalvik <jens.kalvik@...ect.se>
To: bugtraq@...urityfocus.com
Subject: Zyxel / Netgear and probably other routers leaking information.

Hi!

I have discovered a serious problem with the following routers:
Zyxel P310, P314, P324 and Netgaear RT311, RT314 all with the latest firmware available as of 2005-01-20. I think that the problem is present in all routers using Zynos, but I am not sure.

Let say you have a Computer with IP: 192.168.0.50 connected to the WAN side of a router that has 192.168.1.1 on WAN and 192.168.0.1 on the LAN side. If I send a ping to 192.168.0.1 (LAN on router) then I get request timed out, but if I look in my arp cache I will see this:

192.168.0.1 xx-xx-xx-xx-xx-xx

where xx-xx-xx-xx-xx-xx is the mac address of the WAN side. So the result must be that if I send a packet with the same destination IP as the routers LAN IP, I will get an ARP reply from the WAN side. This can be used to get information about which IP adresses are used on the LAN side when you are sitting on the WAN side. It is also possible to pollute the ARP cache on your ISPs equipment by changing the IP adress on your lan side. 

Zyxels response to this is that we have choosen the wrong equipment (I agree :-) they told me to use VLAN as a workaround.

/Jens