[NEWS] Buffer Overflow in Thomson TCW690 Cable Modem HTTP Server

From: SecuriTeam (support_at_securiteam.com)
Date: 03/22/05

  • Next message: SecuriTeam: "[UNIX] IceCast's Multiple Vulnerabilities (XMP parser)" 
    To: list@securiteam.com
Date: 22 Mar 2005 18:45:46 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Buffer Overflow in Thomson TCW690 Cable Modem HTTP Server
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.thomson.net/> Thomson's latest Euro-DOCSIS modem, the TCW690,
    provides a simple Wireless Residential Gateway product solution for cable
    operators and their subscribers.

    The Thomson TCW690 cable-modem is vulnerable to a remote buffer overflow
    by sending a long GET command. This allows an attacker to run arbitrary
    machine code, and cause denial of service as well.

    DETAILS

    An attacker that can access the modem's web interface (usually the
    attacker must be located inside the LAN ) can take advantage of the
    vulnerability, and execute arbitrary code or just cause a denial of
    service on the modem that will cause it to hang approximately 50 seconds.

    Proof of Concept:
    http://192.168.0.1/AAAA[about 2000 A's]AAA

    Disclosure Timeline:
    2005.02.07 - Bug found.
    2005.02.07 - Informed the vendor broadband@thomson.net, no response.
    2005.02.11 - Informed the vendor webmaster@thomson.net.
    2005.02.19 - Public disclosure.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:murdok.lnx@gmail.com>
    MurDoK.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] IceCast's Multiple Vulnerabilities (XMP parser)"

    Relevant Pages

    • [NT] Microsoft Windows 2003 Outlook Web Access URL Injection Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... By using specially crafted URL an attacker can cause a user using ... A vulnerability in Microsoft Windows 20003 Outlook Web Access allows ...
      (Securiteam)
    • [NEWS] Opera Address Bar Spoofing Issue Revisited
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Opera is "a cross-platform web browser". ... The effects of attacks such as this is that an attacker that has ...
      (Securiteam)
    • [UNIX] ZeroBoard PHP Code Injection and XSS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... attacker can cause the script to utilize arbitrary external PHP code. ... For the first vulnerability, and for zboard version 4.1pl4, insert the ...
      (Securiteam)
    • [NT] 2Wire-Gateway Cross Site Scripting And Directory Transversal Bug In SSL Form
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... It includes an SSL (Secure Sockets ... Site Scripting) condition that allows an attacker to change form action ...
      (Securiteam)
    • [UNIX] Mensajeitor Inadequate Permissions Check
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability in the product allows an attacker to ...
      (Securiteam)