lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 27 Oct 2013 14:23:16 -0400 From: Craig Young <vuln-report@...ur3.us> To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: [CVE-2012-6297] DD-WRT v24-sp2 Command Injection Unfortunately command injections like the NETGEAR one Zachary Cutlip and I both came across are all too common in embedded systems. Similar to NETGEAR and Linksys having commands injected when running ping, I have also noticed that DD-WRT v24-sp2 is prone to command injection from specially crafted configuration values containing shell meta-characters. A remote attacker can potentially use CSRF from an authenticated client to remotely execute commands on the router as the root user. This is also an easy way to DoS a system since you could potentially force it into a reboot loop. I reported this in the projects bug tracker almost a year ago but it doesn't look like this is actively maintained so I figured I may as well share with the list now in case anyone is running this firmware. This is tracked as CVE-2012-6297. There are a lot of consumer routers with these types of issues (working with several vendors on this stuff at the moment) so I have provided this list of generic tips for keeping consumer/SOHO routers secure: http://www.tripwire.com/state-of-security/vulnerability-management/five-tips-securing-soho-routers/ I would also love to hear what other suggestions people have towards minimizing the risk of someone popping a shell on your router. Regards, Craig http://secur3.us/pub_key.asc _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists