The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Buffer Overflow in Thomson TCW690 Cable Modem HTTP Server
------------------------------------------------------------------------
SUMMARY
<http://www.thomson.net/> Thomson's latest Euro-DOCSIS modem, the TCW690,
provides a simple Wireless Residential Gateway product solution for cable
operators and their subscribers.
The Thomson TCW690 cable-modem is vulnerable to a remote buffer overflow
by sending a long GET command. This allows an attacker to run arbitrary
machine code, and cause denial of service as well.
DETAILS
An attacker that can access the modem's web interface (usually the
attacker must be located inside the LAN ) can take advantage of the
vulnerability, and execute arbitrary code or just cause a denial of
service on the modem that will cause it to hang approximately 50 seconds.
Proof of Concept:
http://192.168.0.1/AAAA[about 2000 A's]AAA
Disclosure Timeline:
2005.02.07 - Bug found.
2005.02.07 - Informed the vendor broadband@thomson.net, no response.
2005.02.11 - Informed the vendor webmaster@thomson.net.
2005.02.19 - Public disclosure.
ADDITIONAL INFORMATION
The information has been provided by <mailto:murdok.lnx@gmail.com>
MurDoK.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
