full-disclosure-uk May 2007 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] Medium security hole a

Re: [Full-disclosure] Medium security hole affecting DSL-G624T

From: 3APA3A <3APA3A_at_nospam>
Date: Thu May 03 2007 - 21:13:15 GMT
To: Tim Brown <timb@nth-dimension.org.uk>


Dear Tim Brown,

This vulnerability for D-Link DSL-G624T was already reported by Jose Ramon Palanco. See

http://securityvulns.ru/Odocument816.html

Previously, same problem was reported for D-Link DSL-G604T by Qex

http://securityvulns.ru/Mdocument578.html

There were also few more problems reported about /cgi-bin/webcm, see

http://securityvulns.ru/Idocument664.html http://securityvulns.ru/Idocument759.html

--Thursday, May 3, 2007, 2:43:58 AM, you wrote to news@securiteam.com:

TB> Hi, TB> I've identified a couple of security flaws affecting the DSL-G624T firmware. TB> I believe the directory traversal issue has been reported in other devices / TB> firmware versions supplied by D-Link but not the combination I tested and TB> clearly has not been resolved. Additionally, the Javascript injection issue TB> is I believe new and has not been reported on any device. TB> These issues were reported by email to the vendor at the usual addresses TB> (support/security/etc) without response on 13th April 2007. I also attempted TB> to log faults on the vendors support web site but sadly, it would not TB> function adequately using either Firefox nor Konqueror.

TB> Tim

--

~/ZARAZA http://securityvulns.com/
Если даже вы получите какое-нибудь письмо, вы все равно не сумеете его прочитать. (Твен)



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/