[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [Full-Disclosure] Thomson TCW690 Denial Of Service Vulnerability
From: MurDoK <murdok.lnx () gmail ! com>
Date: 2005-02-19 9:43:44
Message-ID: 200502191043.44800.murdok.lnx () gmail ! com
[Download RAW message or body]
I found a vulnerability in this cablemodem which a malicious user inside *LAN
can reset it easily.
This cablemodem model is given by the spanish ISP "AUNA".
Details
=======
Product: Thomson TCW690 cablemodem
Affected Version: ST42.03.0a (possible others)
Immune Version: ???
Security-Risk: high
Exploit: yes
Product-URL:
http://www.thomson.net/EN/Home/MiniSites/BAP/Cable/ModelDetail.html?category=cab%20modem%20Eurodocsis&model=TCW690 \
Vendor-URL: http://www.thomson.net/
Vendor-Status: informed but no response
Description
===========
The http server inside this cablemodem doesn't check the length of GET
requests. If you exploit this bug the router will become unstable for ~50
seconds.
Exploit
=======
No code needed. Just open your browser to
http://192.168.0.1/AAAA[about 2000 A's]AAA
Fix
===
No response from vendor. There isn't fix available.
Vendor Status
==============
2005.02.07 - Bug found.
2005.02.07 - Informed the vendor broadband@thomson.net, no response.
2005.02.11 - Informed the vendor webmaster@thomson.net.
2005.02.19 - Public disclosure.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic