Bugtraq mailing list archives
Re: [Full-Disclosure] Thomson TCW690 Denial Of Service Vulnerability
From: Andres Tarasco <atarasco () gmail com>
Date: Sat, 19 Feb 2005 17:57:11 +0100
Seems to be the same vulnerability published time ago http://www.securityfocus.com/bid/9091 On Sat, 19 Feb 2005 10:43:44 +0100, MurDoK <murdok.lnx () gmail com> wrote:
I found a vulnerability in this cablemodem which a malicious user inside *LAN can reset it easily. This cablemodem model is given by the spanish ISP "AUNA". Details ======= Product: Thomson TCW690 cablemodem Affected Version: ST42.03.0a (possible others) Immune Version: ??? Security-Risk: high Exploit: yes Product-URL: http://www.thomson.net/EN/Home/MiniSites/BAP/Cable/ModelDetail.html?category=cab%20modem%20Eurodocsis&model=TCW690 Vendor-URL: http://www.thomson.net/ Vendor-Status: informed but no response Description =========== The http server inside this cablemodem doesn't check the length of GET requests. If you exploit this bug the router will become unstable for ~50 seconds. Exploit ======= No code needed. Just open your browser to http://192.168.0.1/AAAA[about 2000 A's]AAA Fix === No response from vendor. There isn't fix available. Vendor Status ============== 2005.02.07 - Bug found. 2005.02.07 - Informed the vendor broadband () thomson net, no response. 2005.02.11 - Informed the vendor webmaster () thomson net. 2005.02.19 - Public disclosure. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
-- Loco de aTar
Current thread:
- Re: [Full-Disclosure] Thomson TCW690 Denial Of Service Vulnerability Andres Tarasco (Feb 19)