lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <47BB66A6.4080602@procheckup.com>
Date: Tue, 19 Feb 2008 23:30:46 +0000
From: ProCheckUp Research <research@...checkup.com>
To: full-disclosure@...ts.grok.org.uk
Subject: ZyXEL Gateways Vulnerability Research:
	http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf


This paper is the result of various security assessments performed on 
several ZyXEL Prestige devices in both, a controlled environment 
(computer lab) and production environments during several penetration tests.

There are two types of attacks featured in this paper which we believe 
might be potentially new:

- Persistent XSS via SNMP
- Remote wardriving over the Internet


Additionally, the paper is full of other goodies such as:

- Privilege escalation: it allows retrieving administrative settings 
(i.e.: WEP key, ISP and dynamic DNS credentials) and also altering such 
settings

- SNMP read and SNMP *write* access enabled by default: not only we 
demonstrate  how to change settings but we also show how to obtain the 
credentials for the Dynamic DNS service in cleartext

- Poor session management allows hijacking of admin sessions

- Authentication vulnerable to replay and password cracking attacks

- Disclosure of credentials: several types of credentials travel in the 
clear when being submitted by the user, and also when being returned 
from the web interface back to the browser

http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ