Full Disclosure mailing list archives
SMC7004VB sensitive information leak
From: "Alexander Müller" <alexander.mueller () electronic-security de>
Date: Wed, 3 Sep 2003 16:26:02 +0200 (Westeuropäische Sommerzeit)
:: Advisory Vulnerable: SMC7004VB sensitive information leak Found: July 25th 2003 Vendor: SMC Vendor notified: August 15th 2003 Vendor response: Answered but is on vacation. Public release: August 31th 2003 Vulnerability: An incorrect configuration in the SMC7004VB router allows you to steal usernames and passes. You can also use the IP without spoofing. Some days ago, I scanned the IP of a teammember and LANguard detected an installed proxy. I tried to visit the homepage of this proxy... But there was none. I used the proxy and opened the page again. A saw a loginscript and tried some passes (username isn't required). I tested some passes but the proxy didn't block. Therefore I started a Bruteforceattack and after this I noticed, the proxy did not block after thousands of passes. I aborted this test. That was the proof that you can get the pass with a stupid working attack Alexander Müller Electronic Security www.Electronic-Security.de Thanks to: mo (Kryptocrew.de), Fabian Becker (Electronic Security) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- SMC7004VB sensitive information leak Alexander Müller (Sep 03)