[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: Re: [Full-Disclosure] Thomson TCW690 Denial Of Service Vulnerability
From: Andres Tarasco <atarasco () gmail ! com>
Date: 2005-02-19 16:57:11
Message-ID: 80321d330502190857644e4836 () mail ! gmail ! com
[Download RAW message or body]
Seems to be the same vulnerability published time ago
http://www.securityfocus.com/bid/9091
On Sat, 19 Feb 2005 10:43:44 +0100, MurDoK <murdok.lnx@gmail.com> wrote:
> I found a vulnerability in this cablemodem which a malicious user inside *LAN
> can reset it easily.
> This cablemodem model is given by the spanish ISP "AUNA".
>
> Details
> =======
>
> Product: Thomson TCW690 cablemodem
> Affected Version: ST42.03.0a (possible others)
> Immune Version: ???
> Security-Risk: high
> Exploit: yes
> Product-URL:
> http://www.thomson.net/EN/Home/MiniSites/BAP/Cable/ModelDetail.html?category=cab%20modem%20Eurodocsis&model=TCW690
>
> Vendor-URL: http://www.thomson.net/
> Vendor-Status: informed but no response
>
> Description
> ===========
>
> The http server inside this cablemodem doesn't check the length of GET
> requests. If you exploit this bug the router will become unstable for ~50
> seconds.
>
> Exploit
> =======
>
> No code needed. Just open your browser to
> http://192.168.0.1/AAAA[about 2000 A's]AAA
>
> Fix
> ===
>
> No response from vendor. There isn't fix available.
>
> Vendor Status
> ==============
> 2005.02.07 - Bug found.
> 2005.02.07 - Informed the vendor broadband@thomson.net, no response.
> 2005.02.11 - Informed the vendor webmaster@thomson.net.
> 2005.02.19 - Public disclosure.
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
--
Loco de aTar
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic