[NEWS] Buffer Overflow in Thomson TCW690 Cable Modem HTTP Server

From: SecuriTeam (support_at_securiteam.com)
Date: 03/22/05

  • Next message: SecuriTeam: "[UNIX] IceCast's Multiple Vulnerabilities (XMP parser)" 
    To: list@securiteam.com
Date: 22 Mar 2005 18:45:46 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Buffer Overflow in Thomson TCW690 Cable Modem HTTP Server
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.thomson.net/> Thomson's latest Euro-DOCSIS modem, the TCW690,
    provides a simple Wireless Residential Gateway product solution for cable
    operators and their subscribers.

    The Thomson TCW690 cable-modem is vulnerable to a remote buffer overflow
    by sending a long GET command. This allows an attacker to run arbitrary
    machine code, and cause denial of service as well.

    DETAILS

    An attacker that can access the modem's web interface (usually the
    attacker must be located inside the LAN ) can take advantage of the
    vulnerability, and execute arbitrary code or just cause a denial of
    service on the modem that will cause it to hang approximately 50 seconds.

    Proof of Concept:
    http://192.168.0.1/AAAA[about 2000 A's]AAA

    Disclosure Timeline:
    2005.02.07 - Bug found.
    2005.02.07 - Informed the vendor broadband@thomson.net, no response.
    2005.02.11 - Informed the vendor webmaster@thomson.net.
    2005.02.19 - Public disclosure.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:murdok.lnx@gmail.com>
    MurDoK.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] IceCast's Multiple Vulnerabilities (XMP parser)"

    Relevant Pages