SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Router/Bridge/Hub)  >   NETGEAR Router Vendors:   NETGEAR
NETGEAR RP114 URL Filtering Can By Bypassed With Long URLs
SecurityTracker Alert ID:  1010263
SecurityTracker URL:  http://securitytracker.com/id/1010263
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  May 24 2004
Impact:   Host/resource access via network
Exploit Included:  Yes  
Version(s): RP114
Description:   A vulnerability was reported in the keyword blocking mechanism in the NETGEAR RP114 router. A remote user can bypass URL filters in certain cases.

Marc Ruef reported that the router fails to properly filter URLs when the requested URI is longer than 220 bytes.

The report suggests that this may be due to a buffer overflow and that it may be possible to run arbitrary code on the affected router.

Impact:   A remote user can bypass the URL filtering mechanism in certain cases by using a long URL.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.netgear.com/ (Links to External Site)
Cause:   Boundary error

Message History:   None.


 Source Message Contents

Subject:  [Full-Disclosure] Netgear RP114 URL filter fails if URL is too long


Hi!

Netgear has some small router and firewalling devices for home users and
small companies (SOHO). Most of these solutions are able to do a simple
keyword based URL filtering. Lets say we don't want users to visit
http://www.scip.ch so we create a filter for the keyword "scip.ch". If a
user wants to access a domain that contains the string "scip.ch" (e.g.
www.scip.ch or test.scip.ch) he will get a white html document that says
"Blocked by NETGEAR". He is not able to see the requested document itself.

I found that my cute Netgear RP114 is not able to do the filtering if
the requested URI is more than 220 bytes long. Other Netgear routers and
firewalls may also be affected. If you are requesting the following URL,
you will be able to see the requested web document without restriction:

http://www.scip.ch/?%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20
 

(FYI: your mail client may break the URL into different lines)

An attacker may be able to evade the URL black list and get access to
disallowed ressources. This may be a buffer overflow and it may be
possible to run arbitrary code on the Netgear device. My open-source
Attack Tool Kit (ATK) provides a plugin to check this flaw. See
http://www.computec.ch/projekte/atk/ for more details.

There may be some problems for the attacker if he wants to access a
script (e.g. CGI) that has some problems with the argument after the
question mark. There may be also further problems if the web browser or
server does not allow URLs as long as the needed one.

Netgear may provide a new firmware or another workaround. But their
support is often lame and ignorant (my last few support questions were
be ignored as usual). I suggest to install another URL filtering
solution if this functionality is really needed.

An original copy of this posting can be found at
http://www.computec.ch/mruef/advisories/ - A description of this and
other vulnerabilities on german can be found in the scip Vulnerability
Database at http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=667

Yours, Marc Ruef

-- 
http://www.computec.ch
http://www.scip.ch

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC