Onderwerp: Netgear WG602 Accesspoint vulnerability

KHAMSIN Security News
KSN Reference: 2004-06-03 0001 TIP
---------------------------------------------------------------------------

Title
-----
The Netgear WG602 Accesspoint contains an undocumented
administrative account.

Date
----
2004-06-03


Description
-----------

The webinterface which is reachable from both interfaces (LAN/WLAN)
contains an undocumented administrative account which cannot be disabled.

Any user logging in with the username "super" and the password "5777364"
is in complete control of the device.

This vulnerability can be exploited by any person which is able to reach
the webinterface of the device with a webbrowser.

A search on Google revealed that "5777364" is actually the phonenumber
of z-com Taiwan which develops and offers WLAN equipment for its OEM
customers.

Currently it is unknown whether other Vendors are shipping products
based on z-com OEM designs.


Systems Affected
----------------

Vulnerable (verified)
WG602 with Firmware Version 1.04.0

Possibly vulnerable (not verified)
WG602 with other Firmware Versions
WG602v2
All other z-com derived WLAN Accesspoints


Proof of concept
----------------

Download the WG602 Version 1.5.67 firmware from Netgear
( http://kbserver.netgear.com/support_...asp?dnldID=366 )
and run the following shell commands on a UNIX box:

$ dd if=wg602_1.5.67_firmware.img bs=1 skip=425716 > rd.img.gz
$ zcat rd.img.gz | strings | grep -A5 -B5 5777364

Which results in the following output:

%08lx:%08lx:%s
%08lx%08lx%08lx%08lx
Authorization
BASIC
super <---- Username
5777364 <---- Password
%02x
Content-length
HTTP_USER_AGENT
HTTP_ACCEPT
SERVER_PROTOCOL

Disclaimer
----------

This advisory does not claim to be complete or to be usable for
any purpose. Especially information on the vulnerable systems may
be inaccurate or wrong. Possibly supplied exploit code is not to
be used for malicious purposes, but for educational purposes only.
This advisory is free for open distribution in unmodified form.

http://www.khamsin.ch



---------------------------------------------------------------
KHAMSIN Security GmbH Zuercherstr. 204 / CH-9014 St. Gallen
http://www.khamsin.ch
---------------------------------------------------------------

--Boundary-02=_DBKwA5bsBH5RkpP
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hello,

the WG602v2 is not vulnerable.


Mathias

--Boundary-02=_DBKwA5bsBH5RkpP
Content-Type: application/pgp-signature
Content-Description: signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQBAwKBDJXIDB73UrQoRAosOAJ9LVlD+KKZ5jQnTMKOLN3 BrRilPxgCcDUjM
r00q8v1n7QziT5xuXjdg0Yg=
=prsq
-----END PGP SIGNATURE-----

--Boundary-02=_DBKwA5bsBH5RkpP--

On Thursday, 2004-06-03 at 19:35:22 +0200, Tom Knienieder wrote:

> Possibly vulnerable (not verified)
> WG602 with other Firmware Versions
> WG602v2

The WG602v2 uses different firmware.

> Download the WG602 Version 1.5.67 firmware from Netgear
> ( http://kbserver.netgear.com/support_...asp?dnldID=366 )
WG602v2 Firmware Version 2.0RC5:
http://kbserver.netgear.com/support_...asp?dnldID=504

WG602v2 Repeater Firmware Version 3.2 RC6
http://kbserver.netgear.com/support_...asp?dnldID=692

> and run the following shell commands on a UNIX box:

> $ dd if=wg602_1.5.67_firmware.img bs=1 skip=425716 > rd.img.gz
> $ zcat rd.img.gz | strings | grep -A5 -B5 5777364

2.0RC5
dd if=apfirmware_2.0rc5.img bs=1 skip=111596 of=rd.img.bz2

3.2 RC6
unzip wg602_v2_apfirmware_3.2rc6.zip
dd if=apfirmware_3.2rc6.img bs=1 skip=112620 of=rd.img.bz2

In both cases this:
bzcat rd.img.bz2 | strings | egrep 'Authorization|BASIC|super|5777364'
Returns some garbage, but nothing similar to your output. Also logging
in with super/5777364 does not work with my unit (unknown firmware
release - I forgot the password and have to reset the unit. But it's
getting a little late here.)

HTH,
Lupe Christoph
--
| lupe@lupe-christoph.de | http://www.lupe-christoph.de/ |
| "... putting a mail server on the Internet without filtering is like |
| covering yourself with barbecue sauce and breaking into the Charity |
| Home for Badgers with Rabies. Michael Lucas |

In-Reply-To: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>

I can confirm that this vulnerability still exists in the latest firmware upgrade(1.7.14) for the WG602. They've simply gone and changed the username to superman and password to 21241036.

Jaco Swart <jaco@iblocks.co.uk> writes:

> In-Reply-To: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>
>
> I can confirm that this vulnerability still exists in the latest
> firmware upgrade(1.7.14) for the WG602. They've simply gone and
> changed the username to superman and password to 21241036.

Exactly the same company behaviour, as in the case of xmicro...

Gergely

My WG602v2 with firmware 2.0RC5 does not appear to be vulnerable.
I cannot login with the super/5777364 combination.

Lupe Christoph wrote:

> On Thursday, 2004-06-03 at 19:35:22 +0200, Tom Knienieder wrote:
>
>
>> Possibly vulnerable (not verified)
>> WG602 with other Firmware Versions
>> WG602v2

--
James Garrison Athens Group, Inc.
mailto:jhg@athensgroup.com 5608 Parkcrest Dr
http://www.athensgroup.com Austin, TX 78731
PGP: RSA=0x92E90A3B DH/DSS=0x498D331C (512) 345-0600 x150

In-Reply-To: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>

>Systems Affected
>----------------
>
> Vulnerable (verified)
> WG602 with Firmware Version 1.04.0
>
> Possibly vulnerable (not verified)
> WG602 with other Firmware Versions
> WG602v2
> All other z-com derived WLAN

WG602v2 - doesn't work.

Hi,

Jaco Swart wrote:

> In-Reply-To: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>
>
> I can confirm that this vulnerability still exists in the latest firmware upgrade(1.7.14) for the WG602. They've simply gone and changed the username to superman and password to 21241036.

yes - this is right (though it took me a while to find out how to get
this gzip compressed part out of the img).

Whats new in this image:
"[...] Fixed illegal user access the WEB configuration utility. [...]"

;-)

Would it be possible to change the firmware image by hand - e.g. usa a
hex editor and set this username / password to sth else?

regards,

Harald

--
Team NeueMedien.Net / Hostmaster

CORRECTION - Firmware is 3.1RC5 not 2.0RC5 as I first stated

My WG602v2 with firmware 3.1RC5 does not appear to be vulnerable.
^^^^^^

I cannot login with the super/5777364 combination.

Lupe Christoph wrote:

> On Thursday, 2004-06-03 at 19:35:22 +0200, Tom Knienieder wrote:
>
>
>> Possibly vulnerable (not verified)
>> WG602 with other Firmware Versions
>> WG602v2

--
James Garrison Athens Group, Inc.
mailto:jhg@athensgroup.com 5608 Parkcrest Dr
http://www.athensgroup.com Austin, TX 78731
PGP: RSA=0x92E90A3B DH/DSS=0x498D331C (512) 345-0600 x150