ISE SOHO Vulnerability Catalog Published - Independent Security ...

Attack Requirements
♦ The attacker must have the ability to access the DLNA server.
♦ Authentication is not required for exploitation.
Details
♦ Other firmware versions may be vulnerable.
Impact
If an unauthenticated remote attacker has access to the routers DLNA server, the attacker
can crash the server causing a Denial of Service. The DLNA server will remain unusable
until the router is rebooted.
Recommendations to the Vendor
♦ Implement code logic to handle requests for resources that do not exist.
♦ Additional information for vendors regarding immediate and long term fixes for
these issues can be found here: http://www.securityevaluators.com/content/casestudies/routers/#recommendationsVendors
Solution
♦ There currently is not a solution to this problem.
Proof of Concept Exploit
Make the following web request (Where INT is an arbitrary integer of an non-existent
resource) to the DLNA media server.
♦ http://X.X.X.X:port/MediaItems/INT.mp3
Disclosure Timeline
♦ 2/25/2013 - Notified Netgear
♦ 4/15/2013 - Public Disclosure
References
♦ Advisory/Video: http://infosec42.blogspot.com
♦ http://securityevaluators.com/content/case-studies/
Credit
♦ Discovered By: Jacob Thompson – Security Analyst @ Independent Security
Evaluators
♦ Exploited By: Jacob Thompson – Security Analyst @ Independent Security
Evaluators
37