Authentication vulnerability in Belkin wireless devices

[Andrei Mikhailovsky]

--=-vEI0UXmD/9H3kUtUml5s
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Arhont Ltd. - Information Security

Arhont Advisory by: Andrei Mikhailovsky (www.arhont.com)
Advisory: Belkin Wireless Router Authentication
Vulnerability=20
Router Model Name: F5D7232-4 and F5D7230-4
Model Specific: Other models are likely to be vulnerable
Manufacturer site: http://www.belkin.com


SUMMARY:
A serious security vulnerability have been found in authentication
system of Belkin Wireless Routers. The vulnerability has been confirmed
in Belkin Wireless Routers models F5D7232-4 and F5D7230-4 with latest
firmware 4.05.03 and with firmware 4.03.03. Previous firmware versions
are also likely to be effected. Other Belkin wireless devices are likely
to be vulnerable.


VULNERABILITY DESCRIPTION:
While a legitimate device administrator is logged into the router's web
management interface, any other user/attacker can access, view and
change router's web configuration without authentication from any
network address. This presents an opportunistic vector of attack on the
device in question.


Risk Factor: High/Medium


WORKAROUNDS: At the release time of this advisory, Belkin didn't have
an update that solves the issue. It is advised to filter all requests to
web administration interface of the device.


COMMUNICATION HISTORY:
Manufacturer notified on 11th of October 2005


ADDITIONAL INFORMATION:
*According to the Arhont Ltd. policy, all of the found vulnerabilities
and security issues will be reported to the manufacturer at least 7 days
before releasing them to the public domains (such as CERT and BUGTRAQ).
The delay of the public release might be negotiated with the
manufacturer providing reasonable justifications have been given from
the manufacturer side.

If you would like to get more information about this issue, please do
not hesitate to contact Arhont team on info[_-at-_]arhont[_-dot-_]com=20


--=20
Andrei Mikhailovsky
Arhont Ltd - Information Security

Web: http://www.arhont.com
http://www.wi-foo.com
Tel: +44 (0)870 4431337
Fax: +44 (0)117 9690141
PGP: Key ID - 0x2B3438DE
PGP: Server - keyserver.pgp.com

--=-vEI0UXmD/9H3kUtUml5s
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQBDelns5bSBOf9npPQRAhRYAKCKpFNuMWGoDWiwY/EWF+3SRvFv6gCghs2Q
mwTtNfCzou6ABVlnYOllz/s=
=3Bao
-----END PGP SIGNATURE-----

--=-vEI0UXmD/9H3kUtUml5s--

[Andrei Mikhailovsky]

--=-E6FFDidPnQ0ugshkLRfe
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

This is very odd, as we've reproduced this vulnerability on about 5
different F5D7230-4 with firmware 4.05.3 and 4.03.3, as well as on a few
of the F5D7232-4 routers with the same firmware.

This can't be a network specific setup issue, as we've tested this on
several unrelated networks from Linux and Windows operating systems
using Firefox and MS IE browsers.

Kind Regards,

On Wed, 2005-11-16 at 07:56 -0500, S.A.B.R.O. Net Security wrote:
> Hmmm... we were unable able to reproduce this vulnerability with one of o=
ur
> Belkin Wifi F5D7230-4 with firmware version 4.05.03
>=20
> Once the admin has authenticated any other attempts to access the device=20
> from
> any source (hardwire lan, wifi, remote) displays the following result :
>=20
> Duplicate Administrator
> This device is managed by xxx.xxx.x.x currently!!
>=20

--=20
Andrei Mikhailovsky
Arhont Ltd - Information Security

Web: http://www.arhont.com
http://www.wi-foo.com
Tel: +44 (0)870 4431337
Fax: +44 (0)117 9690141
PGP: Key ID - 0x2B3438DE
PGP: Server - keyserver.pgp.com

--=-E6FFDidPnQ0ugshkLRfe
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQBDezcQ5bSBOf9npPQRAkRBAJ4nNUBhY3dYf/qdejBW/FHEMjXzFgCghWim
uEogBn/NUeuPPIVaU9HTOG0=
=jIQS
-----END PGP SIGNATURE-----

--=-E6FFDidPnQ0ugshkLRfe--