Belkin无线路由器远程认证绕过漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1197187 漏洞类型 访问验证错误
发布时间 2005-11-24 更新时间 2005-11-28
CVE编号 CVE-2005-3802 CNNVD-ID CNNVD-200511-379
漏洞平台 N/A CVSS评分 5.1
|漏洞来源
https://cxsecurity.com/issue/WLB-2005110044
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200511-379
|漏洞详情
贝尔金公司(BelkinCorporation)是周边电子产品的生产厂商,而F5D7232-4和F5D7230-4就是其生产的无线路由器。带有固件4.03.03和4.05.03的BelkinF5D7232-4和F5D7230-4无线路由器,在合法管理员登录到Web管理界面时,可让远程攻击者无需认证即可访问管理界面。
|漏洞EXP
Arhont Ltd. - Information Security

Arhont Advisory by:             Andrei Mikhailovsky (www.arhont.com)
Advisory:            		Belkin Wireless Router Authentication
Vulnerability 
Router Model Name:              F5D7232-4 and F5D7230-4
Model Specific:                 Other models are likely to be vulnerable
Manufacturer site:              http://www.belkin.com

SUMMARY:
A serious security vulnerability have been found in authentication
system of Belkin Wireless Routers. The vulnerability has been confirmed
in Belkin Wireless Routers models F5D7232-4 and F5D7230-4 with latest
firmware 4.05.03 and with firmware 4.03.03. Previous firmware versions
are also likely to be effected. Other Belkin wireless devices are likely
to be vulnerable.

VULNERABILITY DESCRIPTION:
While a legitimate device administrator is logged into the router's web
management interface, any other user/attacker can access, view and
change router's web configuration without authentication from any
network address. This presents an opportunistic vector of attack on the
device in question.

Risk Factor: High/Medium

WORKAROUNDS:  At the release time of this advisory, Belkin didn't have
an update that solves the issue. It is advised to filter all requests to
web administration interface of the device.

COMMUNICATION HISTORY:
Manufacturer notified on 11th of October 2005

ADDITIONAL INFORMATION:
*According to the Arhont Ltd. policy, all of the found vulnerabilities
and security issues will be reported to the manufacturer at least 7 days
before releasing them to the public domains (such as CERT and BUGTRAQ).
The delay of the public release might be negotiated with the
manufacturer providing reasonable justifications have been given from
the manufacturer side.

If you would like to get more information about this issue, please do
not hesitate to contact Arhont team on info[_-at-_]arhont[_-dot-_]com

-- 
Andrei Mikhailovsky
Arhont Ltd - Information Security

Web: http://www.arhont.com
     http://www.wi-foo.com
Tel: +44 (0)870 4431337
Fax: +44 (0)117 9690141
PGP: Key ID - 0x2B3438DE
PGP: Server - keyserver.pgp.com
|参考资料

来源:XF
名称:belkin-wireless-auth-bypass(23059)
链接:http://xforce.iss.net/xforce/xfdb/23059
来源:BID
名称:15444
链接:http://www.securityfocus.com/bid/15444/
来源:SECUNIA
名称:17601
链接:http://secunia.com/advisories/17601/
来源:BUGTRAQ
名称:20051115AuthenticationvulnerabilityinBelkinwirelessdevices
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=113209977115233&w=2
来源:OSVDB
名称:20877
链接:http://www.osvdb.org/20877
来源:VUPEN
名称:ADV-2005-2453
链接:http://www.frsirt.com/english/advisories/2005/2453
来源:SREASON
名称:186
链接:http://securityreason.com/securityalert/186
来源:FULLDISC
名称:20051115AuthenticationvulnerabilityinBelkinwirelessdevices
链接:http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0489.html