Hi!

Netgear has some small router and firewalling devices for home users and
small companies (SOHO). Most of these solutions are able to do a simple
keyword based URL filtering. Lets say we don't want users to visit
http://www.scip.ch so we create a filter for the keyword "scip.ch". If a
user wants to access a domain that contains the string "scip.ch" (e.g.
www.scip.ch or test.scip.ch) he will get a white html document that says
"Blocked by NETGEAR". He is not able to see the requested document itself.

I found that my cute Netgear RP114 is not able to do the filtering if
the requested URI is more than 220 bytes long. Other Netgear routers and
firewalls may also be affected. If you are requesting the following URL,
you will be able to see the requested web document without restriction:

http://www.scip.ch/?%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20 

(FYI: your mail client may break the URL into different lines)

An attacker may be able to evade the URL black list and get access to
disallowed ressources. This may be a buffer overflow and it may be
possible to run arbitrary code on the Netgear device. My open-source
Attack Tool Kit (ATK) provides a plugin to check this flaw. See
http://www.computec.ch/projekte/atk/ for more details.

There may be some problems for the attacker if he wants to access a
script (e.g. CGI) that has some problems with the argument after the
question mark. There may be also further problems if the web browser or
server does not allow URLs as long as the needed one.

Netgear may provide a new firmware or another workaround. But their
support is often lame and ignorant (my last few support questions were
be ignored as usual). I suggest to install another URL filtering
solution if this functionality is really needed.

An original copy of this posting can be found at
http://www.computec.ch/mruef/advisories/ - A description of this and
other vulnerabilities on german can be found in the scip Vulnerability
Database at http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=667

Yours, Marc Ruef

-- 
http://www.computec.ch
http://www.scip.ch