bugtraq - 3Com WIFI router remote administration vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 10 Oct 2007 16:14:01 +0200
From: "Guy Mizrahi" <guy@...king.org.il>
To: <bugtraq@...urityfocus.com>
Subject: 3Com WIFI router remote administration vulnerability.

3Com 3CRWER100-75 is a wireless cable/DSL router (widely used here, in 
israel).

The router has a web management interface in it's port 80 (available from 
inside the network).

When the administrator assign a virtual server to port 80 (In the management 
web filled under the firewall tab) and the line is not checked, the router 
can be remotely managed using any computer in the internet (out of the 
internal network).

When the line is checked – the outside message is TCP ERROR if there is no 
server (if there is a web server – it will display the web site).

This behavior is regardless the fact that the remote management set to off 
(check for the state in the management web under: Advanced- Security-Remote 
Administration).

The router details are:

3C number 3CRWER100-75

Software version 1.2.10ww

Guy Mizrahi (ZuLL)

my hebrew blog: http://hacking.org.il