bugtraq - Thomson TCW690 POST Password Validation Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200502191041.45959.murdok.lnx@gmail.com>
Date: Sat, 19 Feb 2005 10:41:45 +0100
From: MurDoK <murdok.lnx@...il.com>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com, news@...uriteam.com,
        full-disclosure@...ts.netsys.com, vuln@...unia.com
Subject: Thomson TCW690 POST Password Validation
	Vulnerability

I found a vulnerability in this cablemodem which a malicious user inside *LAN 
can get the control of the cablemodem easily. 
This cablemodem model is given by the spanish ISP "AUNA".

Details 
======= 

Product: Thomson TCW690 cablemodem 
Affected Version: ST42.03.0a (not tested in minor versions)
Immune Version: ??? 
Security-Risk: high 
Exploit: yes 
Product-URL: 
http://www.thomson.net/EN/Home/MiniSites/BAP/Cable/ModelDetail.html?category=cab%20modem%20Eurodocsis&model=TCW690 
Vendor-URL: http://www.thomson.net/ 
Vendor-Status: informed but no response 

Description 
=========== 

The http server inside this cablemodem doesn't properly validate the supplied 
password when an user want to do some change in the configuration and sends a 
POST request. In the exploit I show how to change the admin password but you 
can also open ports, deny a user access, restore factory defaults, (all)... 
with a little changes. 

Exploit 
======= 

Attached. 

Fix 
=== 

No response from vendor. There isn't fix available.  

Vendor Status 
============== 
2005.02.06 - Bug found. 
2005.02.07 - Informed the vendor broadband@...mson.net, no response. 
2005.02.11 - Informed the vendor webmaster@...mson.net no response too. 
2005.02.19 - Public disclosure. 

View attachment "mdk_tcw690.c" of type "text/x-csrc" (2648 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html