bugtraq - Multiple vulnerabilities in DASAN H660RM GPON router firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 25 Mar 2019 14:29:25 +0100
From: Krzysztof Burghardt <krzysztof@...ghardt.pl>
To: bugtraq@...urityfocus.com
Subject: Multiple vulnerabilities in DASAN H660RM GPON router firmware

Hi!

CVE-2019-9974: diag_tool.cgi on DASAN H660RM devices with firmware
1.03-0022 allows spawning ping processes without any authorization
leading to information disclosure and DoS attacks

Remote attacker could enumerate hosts on LAN interface sending
requests to /cgi-bin/diag_tool.cgi with ip parameter set to target IP
address. Lack of authorization in /cgi-bin/diag_get_result.cgi allow
retrieval of results. Each call to diag_get_result.cgi retrieves one
line of ping (or traceroute) output.

Same CGI script has another weakness, CWE-400: Uncontrolled Resource
Consumption, which allows memory memory exhaustion Denial of Service
(DoS) attack against device. Around 170 spawned ping processes is
enough to cause crash and reboot of router. PoC exploit available.

More: https://blog.burghardt.pl/2019/03/diag_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-allows-spawning-ping-processes-without-any-authorization-leading-to-information-disclosure-and-dos-attacks/

CVE-2019-9975: syslog_tool.cgi on DASAN H660RM devices with firmware
1.03-0022 uses a hard-coded key for logs encryption

DASAN uses a hard-coded key “dasanektks123” for logs encryption. Data
stored using this key can be decrypted by anyone able to access this
key.

More: https://blog.burghardt.pl/2019/03/syslog_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-uses-a-hard-coded-key-for-logs-encryption/

CVE-2019-9976: Boa Webserver on DASAN H660RM devices with firmware
1.03-0022 saves post data, including credentials, to /tmp/boa-temp

Exploitation is possible for users logged in over telnet of SSH. If
user logged though Web UI and until he make any other POST request,
his credentials can be retrieved with:

$ cat /tmp/boa-temp
StatusActionFlag=-1&Username=admin&Password=vertex25

More: https://blog.burghardt.pl/2019/03/boa-webserver-on-dasan-h660rm-devices-with-firmware-1-03-0022-saves-post-data-including-credentials-to-tmp-boa-temp/

BR,
-- 
Krzysztof Burghardt <krzysztof@...ghardt.pl>
http://www.burghardt.pl/