Re: [scip_Advisory] NetGear RP114 Flooding Denial of Service

[Thierry Zoller <Thierry () Zoller lu>]

Dear Marc Ruef,

MR> III. EXPLOITATION
MR> Running TCP SYN flooding is very simple and can be realized by a large
MR> variety of public attack tools. But it is also possible to initialize
MR> such an attack my misusing a port scanning utility. Starting a scan with
MR> nmap by Fyodor with the following command is able to reproduce the
MR> denial of service:
MR>    nmap -PS80 192.168.0.0/24

Note: This is a device which costs 44,44€

You fail to say whether this is done from INSIDE -> OUTSIDE or vice
versa, which really is the point which makes this a "vulnerability"
instead of a simple bug.

I found countless other Gateways "vulnerable" to this, most SHO DSL gateways even
crash when you run Emule for 24hours (same cause). The reason is that
with the NAT functions they simply can't handle a larger NAT Table
(which grows quite rapidely with SYN scanning..).

I never reported this issue because I thought and I still think this
is not really an security issue.

> VI. WORKAROUND
> Do not plug the RP114 in not-trusted networks where the inter-connection
> requires a high availability.
Who will use an RP114 (44€) for in an high availability environment?



PS. Don't do Pentests over SOHO DSL gateways... it is a baaaad idea.
-- 
http://secdev.zoller.lu
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/