full-disclosure-uk May 2007 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] Medium security hole affec

[Full-disclosure] Medium security hole affecting DSL-G624T

From: Tim Brown <timb_at_nospam>
Date: Wed May 02 2007 - 22:43:58 GMT
To: news@securiteam.com, full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com


Hi,

I've identified a couple of security flaws affecting the DSL-G624T firmware. I believe the directory traversal issue has been reported in other devices / firmware versions supplied by D-Link but not the combination I tested and clearly has not been resolved. Additionally, the Javascript injection issue is I believe new and has not been reported on any device.

These issues were reported by email to the vendor at the usual addresses (support/security/etc) without response on 13th April 2007. I also attempted to log faults on the vendors support web site but sadly, it would not function adequately using either Firefox nor Konqueror.

Tim -- Tim Brown
<mailto:timb@nth-dimension.org.uk>
<http://www.nth-dimension.org.uk/>

_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/