LG Electronics LG3100p router

From: Lukasz Bromirski (lbromirski@mr0vka.eu.org)
Date: 08/22/02 

Date: Thu, 22 Aug 2002 10:19:04 +0200 (CEST)
From: Lukasz Bromirski <lbromirski@mr0vka.eu.org>
To: bugtraq@securityfocus.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Issue: ----------------------------------------------------------------|

 LG Electronics LR3100p is a small WAN router, with two WAN interfaces
 and one Ethernet. It comes with no access lists defined, which enables
 administrator to connect to port 23/tcp (telnet). However, IP stack of
 LR3100p has several bugs, that can be exploited via network.

Description: ----------------------------------------------------------|

 When configured without access lists protecting port 23, the LR3100p is
 vulnerable to at least three (3) bugs, resulting from memory allocation
 function buffer overflows.

 (1)
 First is exploitable without any access to user account at the router.
 Only thing needed is access to port 23/tcp. If the router is attacked
 with data stream (can be any characters, both randomized and text-only
 input was used during testing) coming to that port it will reboot,
 usually with no message.

 (2)
 Second bug is applicable only to software revisions up to and including
 1.30. Few packets generated via simple scanning (for example nmap with
 `-O' option) can result in reboot of the router with following message:

 Exception 1400 at IP 12afc4

 (3)
 Third bug is directly in the telnet service, when checking passwords.
 The same technique with random data stream is used, however few ENTER
 characters should be sent at first, to overcome router primary prompt
 waiting for that key to be pressed. The stream length was measured to
 be about 40kB. Also in this case, router reboots with no message.

Vulnerable versions: --------------------------------------------------|

 Versions up to and including 1.30 are vulnerable to all bugs mentioned.
 Release 1.50 is vulnerable only to first and third bug. The vendor
 representative was informed about the vulnerabilities on 2002-04-18,
 and LG has recently released `fixed' release 1.52 which, however,
 is still vulnerable to first and third bug. This was signalled but
 with no response.

Info on this advisory: ------------------------------------------------|

 This advisory can be accessed on-line at my personal site:
 http://mr0vka.eu.org/docs/advisories/lg-3100p-2002-04-18.txt

 My personal PGP key fingerprint is:
 5C3B 723F A1FA A2BA E57A E959 62A8 63C2 093B 6C49
 My personal PGP key is located at:
 http://mr0vka.eu.org/pgp.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)

iD8DBQE9Y1PiYqhjwgk7bEkRApWcAJ4kYv9uQcaFsqtoyKyopvMXAvMUXQCgyTWH
cl5IBM6E9JFpj6WoSggy+uE=
=1kQa
-----END PGP SIGNATURE----- 

-- 
Łukasz Bromirski                    lbromirski[at]mr0vka.eu.org
PGP key http://mr0vka.eu.org/pgp.asc       http://mr0vka.eu.org
PGP finger   5C3B 723F A1FA A2BA E57A  E959 62A8 63C2 093B 6C49

Relevant Pages

  • [NEWS] LG Electronics LG3100p Router Multiple Security Issues (DoS)
    ... Release 1.50 is vulnerable only to first and third bug. ... When configured without access lists protecting port 23, ... First is exploitable without any access to user account on the router. ... The vendor representative was informed about the vulnerabilities on ...
    (Securiteam)
  • Re: Linux vs LinkSys 4 port Cable router
    ... reconfigure these routers using SNMP is questionable because Linksys has not ... Once again these are not particularly bad vulnerabilities but if you did ... just trusting a router has its benefits. ... and maybe at the session level depending on how Linksys implemented ...
    (comp.security.firewalls)
  • router worms and International Infrastructure [was: Re: IOS exploit]
    ... > follows an EIGRP vector from router to router. ... I wrote this after the release of "the three vulnerabilities", ... dangerous on their own, and consider what a worm, ... Packet Killers" as I like to call them to the world. ...
    (Bugtraq)
  • Re: [Full-disclosure] Ho Ho H0-Day - ZyXEL P-330W multiple XSS and XSRF vulnerabilit
    ... because the router uses GoAhead 2.1.1 for its embedded web ... it is susceptible to all those vulnerabilities including ... There are a plethora of XSS vulns in the web-based management ...
    (Full-Disclosure)
  • RE: FreeBSD NATd problems
    ... Subject: FreeBSD NATd problems ... We also had an internal host infected, and it also caused one of our Cisco ... However, we are running reflexive access lists, rather than ... and eventually code red filled up all the memory in the router ...
    (Incidents)