full-disclosure - Re: [FD] Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web Interface

Open Source and information security mailing list archives

Message-ID: <CAJVRA1SswukNMkgh=d4DLuXiwDXZmmfP=C+c9mmN4q9rOFYP6A@mail.gmail.com>
Date: Sun, 6 Apr 2014 03:00:45 -0700
From: coderman <coderman@...il.com>
To: Palula Brasil <palulabrasil@...il.com>
Cc: Full Disclosure <fulldisclosure@...lists.org>
Subject: Re: [FD] Reflected Cross-Site Scripting within the ASUS RT-AC68U
 Managing Web Interface

On Fri, Apr 4, 2014 at 11:08 AM, Palula Brasil <palulabrasil@...il.com> wrote:
>...
>   Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web Interface
> ...
> * Impact: This vulnerability allows for performing attacks against third party
>           users of the ASUS RT-AC68U web management platform, by luring them
>           into clicking on a link provided with malicious content, which in
>           turn, will execute on the context of the victim's browser.

fun; i keep waiting for these vulns to get old, but it's just still
funny, every time!

best regards,

p.s. see also: "How I Hacked Your Router"
  http://disconnected.io/2014/03/18/how-i-hacked-your-router/

"Security Flaws in Universal Plug and Play: Unplug, Don't Play"
 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play

"DNS Cache Poisoning Issue ("Kaminsky bug") (CVE-2008-1447)"

these tales of woe go on in consumer internet of buggy things -i-verse
for eons.  thus i need say no more. *grin*

more of this story: try to break your hardware before it gets broken;
if you can't make it not break under known methods, build/install
something better!  [you can install Tomato on a RT-AC68U with
functional Tor transproxy and administration via ssh only, as just one
example.]

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives