Dear Tim Brown,
This vulnerability for D-Link DSL-G624T was already reported by Jose
Ramon Palanco. See
http://securityvulns.ru/Odocument816.html
Previously, same problem was reported for D-Link DSL-G604T by Qex
http://securityvulns.ru/Mdocument578.html
There were also few more problems reported about /cgi-bin/webcm, see
http://securityvulns.ru/Idocument664.html
http://securityvulns.ru/Idocument759.html
--Thursday, May 3, 2007, 2:43:58 AM, you wrote to news_at_securiteam.com:
TB> Hi,
TB> I've identified a couple of security flaws affecting the DSL-G624T firmware.
TB> I believe the directory traversal issue has been reported in other devices /
TB> firmware versions supplied by D-Link but not the combination I tested and
TB> clearly has not been resolved. Additionally, the Javascript injection issue
TB> is I believe new and has not been reported on any device.
TB> These issues were reported by email to the vendor at the usual addresses
TB> (support/security/etc) without response on 13th April 2007. I also attempted
TB> to log faults on the vendors support web site but sadly, it would not
TB> function adequately using either Firefox nor Konqueror.
TB> Tim
--
~/ZARAZA http://securityvulns.com/
Если даже вы получите какое-нибудь письмо, вы все равно не сумеете его прочитать. (Твен)
Received on May 03 2007
Intro
