Jens Kalvik
31/01/05, 21:55
Hi!
I have discovered a serious problem with the following routers:
Zyxel P310, P314, P324 and Netgaear RT311, RT314 all with the latest firmware available as of 2005-01-20. I think that the problem is present in all routers using Zynos, but I am not sure.
Let say you have a Computer with IP: 192.168.0.50 connected to the WAN side of a router that has 192.168.1.1 on WAN and 192.168.0.1 on the LAN side. If I send a ping to 192.168.0.1 (LAN on router) then I get request timed out, but if I look in my arp cach
e I will see this:
192.168.0.1 xx-xx-xx-xx-xx-xx
where xx-xx-xx-xx-xx-xx is the mac address of the WAN side. So the result must be that if I send a packet with the same destination IP as the routers LAN IP, I will get an ARP reply from the WAN side. This can be used to get information about which IP adr
esses are used on the LAN side when you are sitting on the WAN side. It is also possible to pollute the ARP cache on your ISPs equipment by changing the IP adress on your lan side.
Zyxels response to this is that we have choosen the wrong equipment (I agree :-) they told me to use VLAN as a workaround.
/Jens
I have discovered a serious problem with the following routers:
Zyxel P310, P314, P324 and Netgaear RT311, RT314 all with the latest firmware available as of 2005-01-20. I think that the problem is present in all routers using Zynos, but I am not sure.
Let say you have a Computer with IP: 192.168.0.50 connected to the WAN side of a router that has 192.168.1.1 on WAN and 192.168.0.1 on the LAN side. If I send a ping to 192.168.0.1 (LAN on router) then I get request timed out, but if I look in my arp cach
e I will see this:
192.168.0.1 xx-xx-xx-xx-xx-xx
where xx-xx-xx-xx-xx-xx is the mac address of the WAN side. So the result must be that if I send a packet with the same destination IP as the routers LAN IP, I will get an ARP reply from the WAN side. This can be used to get information about which IP adr
esses are used on the LAN side when you are sitting on the WAN side. It is also possible to pollute the ARP cache on your ISPs equipment by changing the IP adress on your lan side.
Zyxels response to this is that we have choosen the wrong equipment (I agree :-) they told me to use VLAN as a workaround.
/Jens