| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1112858012.9091.2.camel@localhost.localdomain> Date: Thu Apr 7 08:13:59 2005 From: khermansen at ht-technology.com (Kristian Hermansen) Subject: Cisco Linksys WET11 Password Resetting Vulnerability ================== =====Analysis===== ================== Cisco's Linksys WET11 ethernet bridge product is vulnerable to password resetting based on GET fields in a URL directed at the device. The change password utility provided on the device uses GET to send an obfuscated password as the argument to the changepw.html page. The field that holds the password is named data. Here's what the URL looks like when the user tries to change the password to "admin": http://x.x.x.x/changepw.html?data=XVQsZV3................. The encoding of passwords is quite predictable, and I now show some examples of the passwords "a" through "h": http://x.x.x.x/changepw.html?data=XP...................... http://x.x.x.x/changepw.html?data=Xf...................... http://x.x.x.x/changepw.html?data=Xv...................... http://x.x.x.x/changepw.html?data=Y....................... http://x.x.x.x/changepw.html?data=YP...................... http://x.x.x.x/changepw.html?data=Yf...................... http://x.x.x.x/changepw.html?data=Yv...................... http://x.x.x.x/changepw.html?data=Z....................... This doesn't really matter, since if you are already on the network and can sniff packets, you can just base64 decode the basic auth strings flying by. However, I suggest you change the password blindly on this device using the following: http://x.x.x.x/changepw.html?data=........................ This will create a blank password and allow you to login without knowing the old one. There is no verification when you change the password. In the newest version 1.5.4 of the firmware for the WET11 v1 device, however, someone must have logged in recently (timeout is _LONG_ though) to allow for this attack (ie. it will request the old password). In this scenario, just have them log in to check their settings, and a few minutes later, blank the password. ================== ===Implications=== ================== This attack allows anyone to reconfigure the IP address of the device and change any settings that the device allows. In the latest v1 revision 1.5.4 of the firmware the old password must have been supplied recently to execute the attack. ================== =====Affected===== ================== Tested on Linksys WET11 v1 (1.5.4) Note: older versions may be affected++ Note: WET11 v2 not tested, but may be vulnerable as well ================== =====Solution===== ================== Upgrade to the latest firmware to deter blind password resetting. Be aware that there is still no old password authentication when changing the password even in 1.5.4. http://www.linksys.com/download/firmware.asp -- Kristian Hermansen <khermansen@...technology.com>
Powered by blists - more mailing lists