latinuser_uy
join:2004-07-15
UY
| reply to Hofbrau
Re: Remotely Exploitable Vulnerability In All D-Link Gateways
I saw this one about the DWL-2100ap (havent tested it myself):
»www.intruders.com.br/adv0206en.html
»www.securitytracker.com/alerts/2···234.html
SecurityTracker Alert ID: 1016234
SecurityTracker URL: »securitytracker.com/id?1016234
CVE Reference: GENERIC-MAP-NOMATCH (Links to External Site)
Date: Jun 6 2006
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information
Fix Available: Yes Exploit Included: Yes Vendor Confirmed: Yes
Version(s): D-Link DWL-2100ap; firmware version 2.10na
Description: A vulnerability was reported in the D-Link DWL-2100ap wireless router. A remote user can obtain sensitive information from the target device.
A remote user can directly request files in the '/cgi-bin/' directory with a '.cfg' file extension to obtain the device configuration.
A demonstration exploit URL is provided:
»[target]/cgi-bin/Intruders.cfg
Wendel Guglielmetti Henrique and the Intruders Tiger Team Security discovered this vulnerability.
The original advisory is available at:
»www.intruders.com.br/adv0206en.html
Impact: A remote user can obtain the device configuration, including password information.
Solution: The vendor has reportedly issued a firmware patch, available at:
»www.dlink.com.br/internet/downlo···0343.tfp
Vendor URL: www.dlink.com/ (Links to External Site)
Cause: Access control error
Message History: None. |
