Likes: 0
By opening http://192.168.0.1/setup.cgi?todo=debug you enable the router's debug mode.Then you just telnet at 192.168.0.1 at port 23 and then you have a root shell.
Also i found that if you just telnet to 192.168.0.1 2602 you will get a prompt from the service ZEBRA that is running on the router.By giving "zebra" as password *which is the default password* you got also a root shell.
Dear Sir,
But in order to have access to setup.cgi you need to bypass the .htaccess
protection.
I've tried it on my DG834G and it requires me to enter the .htaccess
password.
Uday K. MOORJANI
----- Original Message -----
From: <thanasonic@hack.gr>
To: <bugtraq@securityfocus.com>
Sent: Thursday, August 12, 2004 1:39 PM
Subject: NETGEAR DG834G SPECIAL FEATURES
>
>
> By opening http://192.168.0.1/setup.cgi?todo=debug you enable the router's
debug mode.Then you just telnet at 192.168.0.1 at port 23 and then you have
a root shell.
>
> Also i found that if you just telnet to 192.168.0.1 2602 you will get a
prompt from the service ZEBRA that is running on the router.By giving
"zebra" as password *which is the default password* you got also a root
shell.
>
>
>
> ---
> avast! Antivirus: Inbound message clean.
> Virus Database (VPS): 0433-2, 10/08/2004
> Tested on: 13/08/2004 09:30:54
> avast! is copyright (c) 2000-2003 ALWIL Software.
> http://www.avast.com
>
>
>
>
---
avast! Antivirus: Outbound message clean.
Virus Database (VPS): 0433-2, 10/08/2004
Tested on: 13/08/2004 10:24:56
avast! is copyright (c) 2000-2003 ALWIL Software.
http://www.avast.com
> -----Original Message-----
> From: thanasonic@hack.gr [mailto:thanasonic@hack.gr]=20
>=20
> By opening http://192.168.0.1/setup.cgi?todo=3Ddebug you enable=20
> the router's debug mode.Then you just telnet at 192.168.0.1=20
> at port 23 and then you have a root shell.
>=20
> Also i found that if you just telnet to 192.168.0.1 2602 you=20
> will get a prompt from the service ZEBRA that is running on=20
> the router.By giving "zebra" as password *which is the=20
> default password* you got also a root shell.
Wow! That's exactly the router I have and these exploits work *fear*.=20
Fortunately, only on the local network, but they work!
With what Firmware version did you test? I still have 1.04 here.
Best regards,
Andre Lorbach
In-Reply-To: <005e01c48141$4e82f880$0701a8c0@COOKIE>
Sorry for not mentioning that.Thats why the subject is called "SPECIAL FEATURE" and not a bug.
By the way, the second issue about zebra its true and as i informed about it ,it can be exploited localy or remotely.
Thanks for your reply,
Thanasonic
The Zebra issue is simply a default password/default configuration
issue. The documentation _clearly_ states that is should be changed and
than an 'enable password' be applied. In neither case does this allow
any "exploit" to take place, as you're restricted to the Zebra process
and not the OS.
It's no more of an exploit than Oracle's system/manager,
sys/change_on_install, or scott/tiger username/password combinations
that are installed by default.
Kind Regards,
-dsp
thanasonic@hack.gr wrote:
> In-Reply-To: <005e01c48141$4e82f880$0701a8c0@COOKIE>
>
> Sorry for not mentioning that.Thats why the subject is called "SPECIAL FEATURE" and not a bug.
> By the way, the second issue about zebra its true and as i informed about it ,it can be exploited localy or remotely.
>
> Thanks for your reply,
> Thanasonic
>
>
Many thanks for that information, I have now changed my Zebra password.
To anyone wishing to carry out the same, its not the easiest thing to carry
out so read the docs carefully and also the terminal "list" instructions.
Maybe Netgear should have included this as part of their setup interface, or
just a mention in their docs would have been good, as I suspect a clever
hack could cause damage with access to this software.
Regards and again my thanks
Paul James
-----Original Message-----
From: Rodrigo Barbosa [mailtoodrigob@suespammers.org]
Sent: 25 August 2004 23:16
To: Paul James
Cc: bugtraq@securityfocus.com
Subject: Re: NETGEAR DG834G SPECIAL FEATURES
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Probably related to this:
URL : http://www.zebra.org/
Summary : Zebra Multiprotocol Routing Daemon
Description :
Zebra is a multi-server routing software package which provides TCP/IP based
routing protocols also with IPv6 support such as RIP, OSPF, BGP and so on.
Zebra turns your machine into a full powered router.
On Tue, Aug 24, 2004 at 12:37:17AM -0000, Paul James wrote:
> In-Reply-To: <20040812173908.5199.qmail@www.securityfocus.com>
>
> My DG834 (non-wireless) also appears vulnerable to the ZEBRA problem, but
only on port 2602.
>
> How does one go about changing this password from the default?
> And what does this ZEBRA service offer?
>
> Unable to find documentation on this.
>
> Regards
- --
Rodrigo Barbosa <rodrigob@suespammers.org> "Quid quid Latine dictum sit,
altum viditur"
"Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQFBLQ+FpdyWzQ5b5ckRApA6AJ9gGG6y9MxPk6dv5kqN3x ixavaHFgCeJWfN
HjnOhH0pA2S1p1j7vmsxx6U=
=2c5E
-----END PGP SIGNATURE-----
In-Reply-To: <20040812173908.5199.qmail@www.securityfocus.com>
My DG834 (non-wireless) also appears vulnerable to the ZEBRA problem, but only on port 2602.
How does one go about changing this password from the default?
And what does this ZEBRA service offer?
Unable to find documentation on this.
Regards
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Probably related to this:
URL : http://www.zebra.org/
Summary : Zebra Multiprotocol Routing Daemon
Description :
Zebra is a multi-server routing software package which provides TCP/IP
based routing protocols also with IPv6 support such as RIP, OSPF, BGP
and so on. Zebra turns your machine into a full powered router.
On Tue, Aug 24, 2004 at 12:37:17AM -0000, Paul James wrote:
> In-Reply-To: <20040812173908.5199.qmail@www.securityfocus.com>
>
> My DG834 (non-wireless) also appears vulnerable to the ZEBRA problem, but only on port 2602.
>
> How does one go about changing this password from the default?
> And what does this ZEBRA service offer?
>
> Unable to find documentation on this.
>
> Regards
- --
Rodrigo Barbosa <rodrigob@suespammers.org>
"Quid quid Latine dictum sit, altum viditur"
"Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQFBLQ+FpdyWzQ5b5ckRApA6AJ9gGG6y9MxPk6dv5kqN3x ixavaHFgCeJWfN
HjnOhH0pA2S1p1j7vmsxx6U=
=2c5E
-----END PGP SIGNATURE-----
On Tue, Aug 24, 2004 at 12:37:17AM -0000, Paul James wrote:
>My DG834 (non-wireless) also appears vulnerable to the ZEBRA problem, but only on port 2602.
>
>How does one go about changing this password from the default?
>And what does this ZEBRA service offer?
Just disable rip in the web interface, you most probably don't need it,
and if you did it would not work anyway, since it is not distributing a
default route.
L.
--
Luca Berra -- bluca@comedia.it
Communication Media & Services S.r.l.
/"\
\ / ASCII RIBBON CAMPAIGN
X AGAINST HTML MAIL
/ \
Quote