[NEWS] Siemens Santis 50 Information Disclosure

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Siemens Santis 50 Information Disclosure
------------------------------------------------------------------------

SUMMARY

"The Siemens Santis 50 Wireless router is a wi-fi (802.11b) ADSL router.
It's a complete system for home and small business networks in a single
device."

A special reset request for the Siemens SANTIS 50 router allows attackers
to retrieve information from the router.

DETAILS

Vulnerable Systems:
* Siemens SANTIS 50 with firmware 4.2.8.0
* Ericsson HN294dp with firmware 4.2.8.0 (OEM version)
* Dynalink RTA300W with firmware 4.2.8.0 (OEM version)

The mentioned routers provides a web management interface and the classic
telnet CLI for administration purposes. By default these services are
available only from the local network, but can be optionally activated
also on the WAN interface.

Sending a trigger packet to the management port (280/http-mgmt) can be
used to "freezes" the web interface, which in turn allows unauthenticated
connection with the telnet CLI.

This behavior appears to be some sort of "disaster recovery mode". The set
of available commands is limited to a few, but they are enough to allow
attackers to discover information about the configuration of the device
and its connections (events, traffic, Ethernet addresses configuration,
etc). In addition, a command that allows to "irreversibly erase FLASH
contents" is made available.

Proof of Concept:
A simple exploit is to use the application scanner AMAP to scan the remote
host's web port causing it to freeze.

ADDITIONAL INFORMATION

The information has been provided by
<mailto:luca.carettoni@securenetwork.it> luca.carettoni.
The original article can be found at:
<http://www.securenetwork.it/advisories/>
http://www.securenetwork.it/advisories/

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.