full-disclosure - Vulnerabilities in D-Link DSL-500T ADSL Router

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <003301ccb84f$38333930$9b7a6fd5@ml>
Date: Sun, 11 Dec 2011 23:51:17 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: Vulnerabilities in D-Link DSL-500T ADSL Router

Hello list!

I want to warn you about security vulnerabilities in D-Link DSL-500T ADSL 
Router.

These are Predictable Resource Location, Brute Force and Cross-Site Request 
Forgery vulnerabilities. I knew about first two holes already from October 
2005, when started to use this router at the office, and third hole I've 
found in April. This is my first advisory from series of advisories about 
vulnerabilities in D-Link products.

-------------------------
Affected products:
-------------------------

Vulnerable is the next model: D-Link DSL-500T ADSL Router.

----------
Details:
----------

Predictable Resource Location (WASC-34):

http://192.168.1.1

The control panel of modem is placed at default path with default login and 
password (admin:admin). Which allows for local users (which have access to 
PC or via LAN) and also for remote users via Internet (via CSRF) to get 
access to control panel and change router's settings.

Default above-mentioned settings - it's standard practice of developers of 
ADSL routers. But ISPs should make changes, but particularly ISP Ukrtelecom 
doesn't do it in modems Callisto (which he offers to his clients), at that 
ISP Intertelecom, which offered this DSL-500T to us in rent, exactly changed 
default password in control panel.

Brute Force (WASC-11):

In login form http://192.168.1.1 there is no protection against Brute Force 
attacks. Which allows to pick up password (if it was changed from default), 
particularly at local attack. E.g. via LAN malicious users or virus at some 
computer can conduct attack for picking up the password, if it was changed.

CSRF (WASC-09):

Lack of protection against Brute Force (such as captcha) also leads to 
possibility of conducting of CSRF attacks, which I wrote about in the 
article Attacks on unprotected login forms 
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-April/007773.html). 
It allows to conduct remote login. Which will be in handy at conducting of 
attacks on different CSRF and XSS vulnerabilities in control panel. Which 
quite can be in it, as I can say based on vulnerabilities in other D-Link 
device, which I've bought in November 2011, and also based on holes in Iskra 
Callisto 821+.

I mentioned about these vulnerabilities at my site 
(http://websecurity.com.ua/5554/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/