7a69Adv#13 - USRobotics AP Wireless Denial of Service

[Albert Puigsech Galicia]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


=2D ------------------------------------------------------------------
7a69ezine Advisories =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
7a69Adv#13
=2D ------------------------------------------------------------------
=A0 http://www.7a69ezine.org [02/08/2004]
=2D ------------------------------------------------------------------

Title: USRobotics AP Wireless Denial of Service

Author: Albert Puigsech Galicia - <ripe@7a69ezine.org>

Software: Embedded HTTP server

Versions: 1.21h

Remote: yes

Exploit: yes

Severity: High

=2D ------------------------------------------------------------------



I. Introduction

USRobotics is an important company that build lot of network devices, like=
=20
modems, wireless cards or wireless access points. It builds also Robots (as=
=20
you can see on "I, Robot" film). To get more information about this company=
=20
you can visit the official website at http://www.usrobotics.com.



II. Description
=09
The USR808054 wireless access point may be administered using HTTP protoco=
l,=20
so the firmwire includes a little HTTP server. The last version of this=20
server has a critical buffer overflow that allow malicious users on the=20
network to produce a denial of service or the execution of arbitrary code.


III. Exploit

A buffer overflow appears on HTTP version string in GET request. You can d=
o=20
the request without administrator password, so all users on the network=20
allowed to connect to http port (all by default) can exploit this issue.=20

This is a exploit code using perl:

bash ~ $ perl -e '$a =3D "GET / " . "A"x250 . "\r\n\r\n" ; print $a' | nc =
ap 80

It crashes down the access point and disconnect all wireless users to the=
=20
network. May be also posible (with knowledge about the architecture used by=
=20
USRobotics) to exploit the vulnerability to execute arbitrary code and get=
=20
total control to the device.


IV. Patch

Not yet.


V. Timeline

19/07/2004 - Notified to spain_modemsupport@usr.com
- No reply


VI. Extra data

I have only tested this vulnerability on my USR808054, but other USR produ=
cts=20
may be also affected.




=2D --
=2D -----------------------------------------------------------------------
Albert Puigsech Galicia

http://www.7a69ezine.org/~apuigsech
=2D -----------------------------------------------------------------------
Este e-mail =A0puede contener =A0informaci=F3n confidencial y/o privilegiad=
a.
Si el presente mensaje no =A0va dirigido a =A0su persona =A0(o lo ha recibi=
do
por error) por favor, =A0notif=EDquelo inmediatamente =A0al emisor y destru=
ya
este e-mail. Cualquier divulgaci=F3n, =A0copia o distribuci=F3n no autoriza=
da
del material contenido en este e-mail queda prohibida.
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBDcyYiLW5f5WBvGcRAmQAAJ95CHJnT1AKiQ/mq6lXhJbGspIdNwCdEC+b
agHJzXOTEyiGwq+8+y5zzOg=3D
=3D6YBo
=2D----END PGP SIGNATURE-----