[<prev] [next>] [day] [month] [year] [list]
Message-ID: <FB24803D1DF2A34FA59FC157B77C97050313D262@idserv04.idef.com>
From: idlabs-advisories at idefense.com (idlabs-advisories@...fense.com)
Subject: iDEFENSE Security Advisory 08.05.04: Thompson SpeedTouch Home ADSL
Modem Predictable TCP ISN Generation
Thompson SpeedTouch Home ADSL Modem Predictable TCP ISN Generation
iDEFENSE Security Advisory 08.05.04
www.idefense.com/application/poi/display?id=120&type=vulnerabilities
August 5, 2004
I. BACKGROUND
The Thompson (formerly Alcatel) SpeedTouch is an ADSL router for home
and business providing a continuously available, "always on,"
connection. More information about the product can be found at
http://www.speedtouchdsl.com/.
II. DESCRIPTION
Remote exploitation of a design error vulnerability in Thompson's
SpeedTouch Home ADSL modem allows attackers to spoof TCP traffic on
behalf of the device.
The problem specifically exists due to the predictable nature of the TCP
Initial Sequence Number (ISN) generator on the device. The following
sanitized tcpdump output demonstrates the existence of the vulnerability
when 10 consecutive TCP connection requests are generated for the telnet
server (port 23) on the Thompson device:
48.3 host_a.1096 > host_b.telnet: S
48.3 host_b.telnet > host_a.1096: S 4081040897:4081040897(0) ack
48.3 host_a.1096 > host_b.telnet: R
48.4 host_a.1096 > host_b.telnet: S
48.4 host_b.telnet > host_a.1096: S 4081104897:4081104897(0) ack
48.4 host_a.1096 > host_b.telnet: R
48.6 host_a.1096 > host_b.telnet: S
48.6 host_b.telnet > host_a.1096: S 4081232897:4081232897(0) ack
48.6 host_a.1096 > host_b.telnet: R
48.7 host_a.1096 > host_b.telnet: S
48.7 host_b.telnet > host_a.1096: S 4081296897:4081296897(0) ack
48.7 host_a.1096 > host_b.telnet: R
48.9 host_a.1096 > host_b.telnet: S
48.9 host_b.telnet > host_a.1096: S 4081360897:4081360897(0) ack
48.9 host_a.1096 > host_b.telnet: R
49.0 host_a.1096 > host_b.telnet: S
49.0 host_b.telnet > host_a.1096: S 4081488897:4081488897(0) ack
49.0 host_a.1096 > host_b.telnet: R
49.2 host_a.1096 > host_b.telnet: S
49.2 host_b.telnet > host_a.1096: S 4081552897:4081552897(0) ack
49.2 host_a.1096 > host_b.telnet: R
49.3 host_a.1096 > host_b.telnet: S
49.3 host_b.telnet > host_a.1096: S 4081616897:4081616897(0) ack
49.3 host_a.1096 > host_b.telnet: R
49.5 host_a.1096 > host_b.telnet: S
49.5 host_b.telnet > host_a.1096: S 4081744897:4081744897(0) ack
49.5 host_a.1096 > host_b.telnet: R
49.6 host_a.1096 > host_b.telnet: S
49.6 host_b.telnet > host_a.1096: S 4081808897:4081808897(0) ack
49.6 host_a.1096 > host_b.telnet: R
In the above example, host_a is the querying host and host_b is the
Thompson device. A clear pattern in ISN generation can be seen as the
value increases by approximately 64,000 each millisecond.
III. ANALYSIS
Successful exploitation of weak ISNs for the purpose of connection
spoofing is not a trivial task. Successful exploitation allows an
attacker to generate traffic on behalf of the affected device. Such an
ability is most dangerous when trust paths exist between the affected
device and another remote system.
IV. DETECTION
iDEFENSE has verified the existence of this vulnerability in Thompson's
SpeedTouch firmware version GV8BAA3.270 (1003825). It is suspected that
earlier versions are susceptible to exploitation as well.
V. WORKAROUNDS
Untrusted traffic should be filtered at the network perimeter.
VI. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-0641 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
VII. DISCLOSURE TIMELINE
06/08/04 Initial vendor contact - no response
06/08/04 iDEFENSE clients notified
06/18/04 Secondary vendor contact - no response
08/05/04 Public disclosure
VIII. CREDIT
The discoverer wishes to remain anonymous.
Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp
IX. LEGAL NOTICES
Copyright (c) 2004 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@...fense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
Powered by blists - more mailing lists