full-disclosure - Thomson TCW690 Denial Of Service Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200502201151.57189.murdok.lnx@gmail.com>
From: murdok.lnx at gmail.com (MurDoK)
Subject: Thomson TCW690 Denial Of Service Vulnerability

El S?bado, 19 de Febrero de 2005 17:57, Andres Tarasco escribi?:

Yes, I saw that vulnerability but as securityfocus only says that cablemodems
affected were TCM 305 and TCM 315 I decided to send it too.

> Seems to be the same vulnerability published time ago
>
> http://www.securityfocus.com/bid/9091
>
> On Sat, 19 Feb 2005 10:43:44 +0100, MurDoK <murdok.lnx@...il.com> wrote:
> > I found a vulnerability in this cablemodem which a malicious user inside
> > *LAN can reset it easily.
> > This cablemodem model is given by the spanish ISP "AUNA".
> >
> > Details
> > =======
> >
> > Product: Thomson TCW690 cablemodem
> > Affected Version: ST42.03.0a (possible others)
> > Immune Version: ???
> > Security-Risk: high
> > Exploit: yes
> > Product-URL:
> > http://www.thomson.net/EN/Home/MiniSites/BAP/Cable/ModelDetail.html?categ
> >ory=cab%20modem%20Eurodocsis&model=TCW690 Vendor-URL:
> > http://www.thomson.net/
> > Vendor-Status: informed but no response
> >
> > Description
> > ===========
> >
> > The http server inside this cablemodem doesn't check the length of GET
> > requests. If you exploit this bug the router will become unstable for ~50
> > seconds.
> >
> > Exploit
> > =======
> >
> > No code needed. Just open your browser to
> > http://192.168.0.1/AAAA[about 2000 A's]AAA
> >
> > Fix
> > ===
> >
> > No response from vendor. There isn't fix available.
> >
> > Vendor Status
> > ==============
> > 2005.02.07 - Bug found.
> > 2005.02.07 - Informed the vendor broadband@...mson.net, no response.
> > 2005.02.11 - Informed the vendor webmaster@...mson.net.
> > 2005.02.19 - Public disclosure.
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html