The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Multiple Vulnerabilities in Gigafast Router (Authentication Bypass, DoS)
------------------------------------------------------------------------
SUMMARY
<http://www.gigafast.com> GigaFast 10/100 Ethernet router EE400-R is a
DSL\Cable router that contains 4 ports of LAN and a WAN port. It support
DHCP, Multiple IP sharing and a web based interface.
GigaFast Ethernet router contains two vulnerabilities, one that allows to
bypass the authentication mechanism while the other can be used to cause a
DoS.
DETAILS
Vulnerable Systems:
* GigaFast Firmware from 12/07/2004 and possibly prior.
Authentication Bypass Vulnerability:
The router has a login page; however, this may easily be bypassed. To
retrieve the router's backup file, which contains some of the routers
preferences, including the administrator password in plain-text, all he
needs to do is access the following URL:
http://ROUTER-ADDRESS/backup.cfg
If remote administration is enabled, any individual connected to the
Internet would be able to download this configuration file and see the
administrator password. If remote administration has not been enabled only
LAN users would be able to issue such a request.
DoS Vulnerability:
If the DNS proxy option is turned on, it is possible to interrupt the
connection by sending the router a malformed DNS query. Once the router
receives the malformed DNS query, it will not work until a cold boot has
been performed.
This vulnerability can only be triggered from the inside (via the LAN
interface).
ADDITIONAL INFORMATION
The information has been provided by <mailto:gary@pointblanksecurity.com>
Gary H. Jones II.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
