Home page logo
/

bugtraq logo Bugtraq mailing list archives

[CVE-2012-6297] DD-WRT v24-sp2 Command Injection
From: Craig Young <vuln-report () secur3 us>
Date: Sun, 27 Oct 2013 14:23:16 -0400

Unfortunately command injections like the NETGEAR one Zachary Cutlip
and I both came across are all too common in embedded systems.

Similar to NETGEAR and Linksys having commands injected when running
ping, I have also noticed that DD-WRT v24-sp2 is prone to command
injection from specially crafted configuration values containing shell
meta-characters.  A remote attacker can potentially use CSRF from an
authenticated client to remotely execute commands on the router as the
root user.  This is also an easy way to DoS a system since you could
potentially force it into a reboot loop.

I reported this in the projects bug tracker almost a year ago but it
doesn't look like this is actively maintained so I figured I may as
well share with the list now in case anyone is running this firmware.
This is tracked as CVE-2012-6297.

There are a lot of consumer routers with these types of issues
(working with several vendors on this stuff at the moment) so I have
provided this list of generic tips for keeping consumer/SOHO routers
secure: http://www.tripwire.com/state-of-security/vulnerability-management/five-tips-securing-soho-routers/

I would also love to hear what other suggestions people have towards
minimizing the risk of someone popping a shell on your router.

Regards,
Craig
http://secur3.us/pub_key.asc


  By Date           By Thread  

Current thread:
  • [CVE-2012-6297] DD-WRT v24-sp2 Command Injection Craig Young (Oct 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]