exploit the possibilities

Netgear WNDRMAC 1.0.0.22 Information Disclosure

Netgear WNDRMAC 1.0.0.22 Information Disclosure
Posted May 13, 2012
Authored by Nathaniel Carew | Site senseofsecurity.com.au

Netgear WNDRMAC versions 1.0.0.22 and below suffer from a serial number disclosure vulnerability.

tags | exploit, web
MD5 | 0913662c2b34c063e6a05bc4652c7a8f

Netgear WNDRMAC 1.0.0.22 Information Disclosure

Change Mirror Download
Sense of Security - Security Advisory - SOS-12-005

Release Date. 13-May-2012
Last Update. -
Vendor Notification Date. 06-Mar-2012
Product. NETGEAR WNDRMAC
Platform. Hardware
Affected versions. 1.0.0.22 and below
Severity Rating. High
Impact. Exposure of sensitive information
Attack Vector. From remote without authentication
Solution Status. Currently no software update; the
vulnerable functionality can be disabled
CVE reference. CVE - not yet assigned

Details.
The NETGEAR Wireless Extreme for Mac computer and PCs (WNDRMAC)
is a N600 wireless dual-band gigabit router. The router
discloses sensitive information in the page source, if a
previous password recovery has been successfully completed,
which allows an attacker to login to the device.

Proof of Concept.
Viewing the source code of the page you are presented with when
you fail to login successfully with the administrator account
exposes the routers serial number which is required to get to the
recovery questions section.

http://x.x.x.x/unauth.cgi
<HTML><HEAD><LINK rel="stylesheet" href="/style/form.css">
<TITLE> 401 Authorization</TITLE>
<META http-equiv=content-type content='text/html; charset=UTF-8'>
<script>
function loadvalue()
{
var enable_recovery="1";
var enter_sn_again="0";
var last_error_sn="2T82195D0093D";
if( enable_recovery == "1" )

Viewing the source code of the recovery questions page allows an
attacker to view the answers to the password recovery questions.
After submitting these answers you are presented with the current
administrator credentials.

http://x.x.x.x/securityquestions.cgi
<HTML><HEAD>
<TITLE> Router Password Recovery</TITLE>
<META http-equiv=content-type content='text/html; charset=UTF-8'>
<LINK rel="stylesheet" href="/style/form.css">
<script>
var quest1_1="What was the name of the first NETGEAR product you
purchased?";
var quest1_2="What was the name of the first school you attended?";
function loadvalue()
{
var answer_again="1";
var last_error_ans1="Answer one";
var last_error_ans2="Answer two";

Solution.
Disable the password recovery option.

Discovered by.
Nathaniel Carew from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-12-005.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    15 Files
  • 22
    Feb 22nd
    2 Files
  • 23
    Feb 23rd
    2 Files
  • 24
    Feb 24th
    16 Files
  • 25
    Feb 25th
    37 Files
  • 26
    Feb 26th
    15 Files
  • 27
    Feb 27th
    15 Files
  • 28
    Feb 28th
    4 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close