ISE SOHO Vulnerability Catalog Published - Independent Security ...

♦ 3/29/2013 - Notified ASUS
♦ 7/26/2013 – Public Disclosure
References
♦ Advisory/Video: http://infosec42.blogspot.com
♦ http://securityevaluators.com/content/case-studies/
Credit
♦ Discovered By: Jacob Holcomb – Security Analyst @ Independent Security
Evaluators
♦ Exploited By: Jacob Holcomb – Security Analyst @ Independent Security
Evaluators
Vulnerability: Persistent Code Execution (File-­‐system Permissions)
CVE: CVE-2013-3094
Description
The ASUS RT-N56U contains read, write, and execute permissions throughout its filesystem.
If an attacker is able to get access to the routers file-system through FTP, SMB,
or CSRF reverse-shell, the attacker can replace system executable with his or her own
code and persuade the router to execute it. This results in persistent shell level access to
the router.
Attack Requirements
♦ Gain access to the routers file-system though SMB, FTP, or CSRF
Details
The asusware directory contains several system binaries, configuration files, and scripts
that can be altered to perform actions of an attackers choosing.
Impact
Once the attacker gains access to the router, the attacker can insert attacker-controlled
code and gain unfettered access to the router.
Recommendations to the Vendor
♦ Change the file-system permissions.
♦ Additional information for vendors regarding immediate and long term fixes for
these issues can be found here: http://www.securityevaluators.com/content/case-
90