Home page logo

oss-sec logo oss-sec mailing list archives

Re: D-Link DCS-2121 Semicolon Vulnerability
From: Josh Bressers <bressers () redhat com>
Date: Wed, 14 Sep 2011 14:15:18 -0400 (EDT)

I'm going to leave this one to MITRE. I want to stick with the current list policy of only assigning IDs to open source 



----- Original Message -----

I've come up with this [0] blog post which, accordingly to author,
describes a 0day vulnerability within D-Link DCS-2121 camera.

In summary, the data posted from the web configuration interface to
samba is
directly used as a parameter without proper sanitization. This leads
an unwanted system call.

Although the author says that the vulnerability can only be used by
authenticated users via web interface, it would be dangerous together
with CSRF on authenticated user. I think that it's worth looking, or,
least let the vendor know.

Disclaimer (for not-so-funny people): yes this is "0day", unreported
the vendor. I even suspect the whole D-Link product line is vulnerable
to the same bug (if not the whole world of low-end embedded systems
even business class products)). However, since Web access requires
authentication, this bug might be exploitable by administrators only,
it is only useful for people who would like to gain a shell on their
systems. Do not panic :)



. 73! DE TA1AET

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]