bugtraq - Re: yet another DSL modem backdoor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <000801c50f74$4d35ed90$0900a8c0@laptop>
Date: Thu, 10 Feb 2005 13:27:42 -0000
From: "Philip Barnham" <admin@...ktech.org.uk>
To: "Adam Laurie" <adam.laurie@...bunker.net>,
        "bugtraq" <bugtraq@...urityfocus.com>,
        "full disclosure" <full-disclosure@...ts.netsys.com>
Subject: Re: yet another DSL modem backdoor - Mentor
	(Conexant)


the latest firmware fixes this issue, however manufacturers are still 
selling these items with non-updated firmware.

i always recommend anyone who buys one of these connexant based routers to 
upgrade the firmware, which a bootable upgrade cd can be downloaded from 
www.origo-repair.org.uk

----- Original Message ----- 
From: "Adam Laurie" <adam.laurie@...bunker.net>
To: "bugtraq" <bugtraq@...urityfocus.com>; "full disclosure" 
<full-disclosure@...ts.netsys.com>
Sent: Wednesday, February 09, 2005 6:58 PM
Subject: yet another DSL modem backdoor - Mentor (Conexant)


> Amazingly, despite numerous reports of backdoors in these Conexant DSL 
> routers, they are *still* being shipped with the port 254 backdoor menu 
> enabled...
>
> I've just switched ADSL provider, and the new modem they sent me was a 
> "Mentor MR4C/UK". It appears to be another conexant clone, and if you 
> telnet to port 254 you get the familiar:
>
> 01/01/99                   CONEXANT SYSTEMS, INC. 00:00:38
>              ATU-R ACCESS RUNNER ADSL TERMINAL (Annex A) 3.27
>
> and options to set password, reset router to default values, etc. etc. As 
> before, you cannot change the login password on this interface, which is, 
> in this case, "conexant".
>
> Although this fault and the fix have been posted before, I report this as 
> a reminder, and a nag to those feeble manufacturers that haven't got their 
> act together...
>
> To work around, set up virtual servers that send the port to a black hole.
>
> If your ISP has shipped you one of these, *TELL* them! Maybe they have 
> enough purchasing power to get it sorted...
>
> cheers,
> Adam
> -- 
> Adam Laurie                         Tel: +44 (20) 7605 7000
> The Bunker Secure Hosting Ltd.      Fax: +44 (20) 7605 7099
> Shepherds Building                  http://www.thebunker.net
> Rockley Road
> London W14 0DA                      mailto:adam@...bunker.net
> UNITED KINGDOM                      PGP key on keyservers
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html