SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Router/Bridge/Hub)  >   Ericsson Modem Vendors:   Ericsson
(An Exploit Method is Described) Ericsson ADSL Modem Web Management Interface Grants Access to Any Remote User
SecurityTracker Alert ID:  1009520
SecurityTracker URL:  http://securitytracker.com/id/1009520
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Mar 23 2004
Impact:   Root access via network
Exploit Included:  Yes  
Version(s): Model HM220dp
Description:   An authentication vulnerability was reported in the Ericsson HM220dp ADSL Modem. A remote user can access the device via the web-based interface.

It is reported that the device's web interface does not and cannot authenticate remote users. In some versions, the web administration page may only be accessible via the local area network (LAN).

Roberto Dapino has described an exploit method [see the Source Message]. A remote user can create HTML that, when loaded by a target user on the internal LAN, will execute arbitrary scripting code that can access the web interface and change the modem's configuration.

Impact:   A remote user can access the web management interface.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.ericsson.com/homeproducts/broadbandmodem/adsl_hm220d_spec.shtml (Links to External Site)
Cause:   Authentication error

Message History:   This archive entry is a follow-up to the message listed below.
Feb 11 2003 Ericsson ADSL Modem Web Management Interface Grants Access to Any Remote User



 Source Message Contents

Subject:  DSL Modem Ericsson HM220dp Exploit




SYSTEMS AFFECTED ========

DSL Modem Ericsson HM220dp



CONTENTS =========

Subject: DSL Modem Ericsson HM220dp Exploit
Date: February 22, 2004
Risk: Moderate



DESCRIPTION =========

This is the natural consequence of the following security flaw:

http://www.secunia.com/advisories/8057/
http://www.securityfocus.com/bid/6824/info/

The Ericsson HM220dp DSL modem/router provides no authentication for his Web Administration panel.
So, a malicious user can access the panel and change settings on a local network.

I discovered another serious implication of this bug: the vulnerability can be exploited also throughout a web page, this means that
 a script contained in a malicious web site (or e-mail) can modify the modem configuration; is also possible to interrupt the modem
 connection. 



DETAILS =========

This is a proof-of-concept:


[script]
function exploit(){
window.location = "view-source:http://192.168.254.254/dummy.html?reboot=1";
}
[/script]
[input type="button" value="disconnect" onClick="exploit();"]



WORKAROUNDS ========

By changing the modem's default IP address (192.168.254.254) the exploit cannot work. In order to patch the flaw Ericsson also provided
 the following update:

http://www.wii.ericsson.net/xdslterminals/files/CXC_132_2094-R3F.exe
http://www.wii.ericsson.net/xdslterminals/files/Readme_Instruction_HowTo_update.txt



DISCLAIMER ========

These informations are supplied for educational purpose only. 
The author is not liable for the direct or indirect use of these
informations, which can't be used in order to modify or interrupt the operations of informatic systems. 



LEGAL NOTICE ========

This advisory is Copyright (c) 2004 Roberto Dapino.
It can be reproduced without the author's written permission
only if unmodified.



CREDITS =========

Vulnerability found by Roberto Dapino, Italy.
roberto(at)xdesign.it - - www.stormvision.it


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC