DLINK 614+ - SOHO routers, system DOS

From: Gregory Duchemin (c3rb3r_at_sympatico.ca)
Date: 06/28/04

  • Next message: D'Amato Luigi: "ZH2004-14SA (security advisory):Sql Injection in Infinity WEB" 
    Date: Sun, 27 Jun 2004 19:47:47 -0700
To: bugtraq@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
     
    TITLE: DLINK 614+ - SOHO routers, system DOS (http://www.dlink.com)

    TYPE: ressources starvation / system denial of service

    QUOTE from DLINK:

    The AirPlus DI-614+ combines the latest advancements in 802.11b
    silicon chip
    design from Texas Instruments, utilizing their patented Digital Signal
    ProcessingTM technology, and D-Link's own robust firewall security
    features.
    ...
    The D-Link AirPlus DI-614+ is the ideal networking solution for small
    offices,
    home offices, schools, coffee shops and other small businesses that
    cater to the
    public.

    DETAILS:

    The DI614+ SOHO router (latest firmware rev 2.30) will automaticaly
    reboot when flooded with valid DHCP REQUEST packets
    built with forged source mac addresses or unique CLIENTID and sent
    without any REQUESTEIP option.
    Upon reception of this kind of requests, DLINK's DI614+ normally
    behaves by checking if a lease is available
    and then reply by offering an ip address along with other network
    settings as configured through the web base interface.
    However if such packets are sent at a good enough rate, the DLINK box
    will be left in an unstable state immediately followed by a system reboot.
    Timing is quite important here and make me thinking that too much
    simultaneous requests force the SOHO router to eventually allocate
    too much memory and thus to reboot.
    It is actually hard to know with precision where the problem actually
    lives since no sources are made available for public.

    Note that a reboot will clear any existing lease (as well as logs) and
    may introduce a subsequent chaos between DHCP clients.
    Also note that only few seconds are necessary to DOS the box this way,
    even less time than needed by the system to reboot.
    So it is a condition of permanent denial of service.

    DLINK 614+ is used, among others, by coffee shops, therefore a
    successful exploitation may have very disturbing effects.

    EXPLOITATION:

    This bug will NOT be triggered if a REQUESTIP DHCP option is sent
    along with the request
    or if no ip address is available for dynamic lease at the time of the
    attack.

    Also for a successful exploitation, packets must be sent at a high
    enough rate (ie: 50 packets/s is working)

    VENDOR:

    DLINK's support staff has been contacted by May 24th but doesn't
    bother to reply

    WORKAROUND:

    Use static leasing only and/or disable DLINK's DHCP service

    VULNERABLE:

    firmware up to rev 2.30 (latest)

    AUTHOR: Gregory Duchemin (c3rb3r at sympatico.ca)

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.4 (MingW32)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
     
    iD8DBQFA34bT9K2fGbOmSdYRAu2OAJ9bHrnk0ExcYMEJXZZROUX60vdkLACeNFTV
    mF/uH+rt929VhMDxuysJPug=
    =jTkm
    -----END PGP SIGNATURE-----

  • Next message: D'Amato Luigi: "ZH2004-14SA (security advisory):Sql Injection in Infinity WEB"

    Relevant Pages

    • Re: DLINK 614+ - SOHO routers, system DOS
      ... the flaws reported to DLINK on May 24th and posted to bugtraq have ... Rev A's latest firmware available is still 2.30 and therefore IS ... | left in an unstable state immediately followed by a system reboot. ... | along with the request or if no ip address is available for dynamic ...
      (Bugtraq)
    • Re: DLINK 614+ - SOHO routers, system DOS
      ... a followup concerning the two DOSes that were found affecting DLINK's DI ... >> reboot when flooded with valid DHCP REQUEST packets ...
      (Bugtraq)
    • Re: IP Spoofing
      ... That would be enough if the purpose of the request was e.g. to delete a database by SQL injection. ... You would not need to keep it in 7 packets, merely to send in a TCP window - pretty large these days, BUT you would also need to cut in on an existing ESTABLISHED session. ... You need to know all about the TCP session as well as the senders IP address AND current sender port number, or the packet will be discarded as not part of any TCP session the server knows about. ...
      (comp.lang.php)
    • Re: IP Spoofing
      ... That would be enough if the purpose of the request was e.g. to delete a database by SQL injection. ... You would not need to keep it in 7 packets, merely to send in a TCP window - pretty large these days, BUT you would also need to cut in on an existing ESTABLISHED session. ... There is nothing in the TCP/IP protocol which disallows it, and the packets will be quite happily sent to the server. ...
      (comp.lang.php)
    • Re: iptables help needed
      ... Packets are dropped because port 110 is not allowed ... I added port 110 to your script ... | the desktop this morning when i started the laptop and ran firefox. ... Here the 192.168.1.4 computer makes an ntp request to 213.251.134.188 ...
      (Fedora)