full-disclosure - Alice Telecom Italia AGPF ADSL router CSRF reconfiguration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHPiOv9DzrEh_DUjbRmVMhXDOYDi7aHPd0J7yzPDRw1KiYG+cw@mail.gmail.com>
Date: Sun, 2 Sep 2012 14:03:08 +0200
From: Emilio Pinna <emilio.pinn@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Alice Telecom Italia AGPF ADSL router CSRF
	reconfiguration

################# Alice Telecom Italia AGPF ADSL router CSRF
reconfiguration #################

## ABSTRACT

An huge number of ADSL broadband Italian users are vulnerable to
connection wiretapping and phishing. The most widely distribuited
italian ADSL router Alice Gate 2 Plus Voip Wi-Fi (AGPF), produced by
Pirelli, suffers a CSRF attack that allows an attacker to modify
internal router configuration like DNS servers, traffic routing, VoIP
configurations, DHCP parameters, and and other configurations that may
lead to a complete takeover of the user's ADSL connection. The
technique is also useful to enable hidden feature and
telnet/ftp/tftp/web extended admin interface.

## VENDOR: Alice Telecom Italia Modem/Routers manufactered by Pirelli
## MODEL: AGPF[Alice Gate VoIP 2 Plus Wi-Fi] version < 2.6.0
## PLATFORM: Customized Linux with openrg middleware on Broadcom
BCM96348 chipset.
## VULNERABILITY: CSRF and configuration injection via HTTP POST parameter
## EMAIL: emilio.pinn gmail
## AUTHOR: Emilio Pinna
## RISK: high

More details are published in Dissecting blog:

Introduction: http://disse.cting.org/2012/09/02/alice-gate-agpf-csrf-reconf-vulnerability/
Technical details:
http://disse.cting.org/2012/09/02/alice-gate-agpf-csrf-reconf-vulnerability-details/
POC: http://disse.cting.org/codes/alice.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/