[Full-Disclosure] iDEFENSE Security Advisory 08.05.04: Thompson SpeedTouch Home ADSL Modem Predictable TCP ISN Generation

Thompson SpeedTouch Home ADSL Modem Predictable TCP ISN Generation iDEFENSE Security Advisory 08.05.04 www.idefense.com/application/poi/display?id=120&type=vulnerabilities August 5, 2004 I. BACKGROUND The Thompson formerly Alcatel SpeedTouch is an ADSL router for home and business providing a...

CVE-2004-0680

The CVE concerns the Zoom X3 ADSL modem: a terminal on port 254 can be accessed using the default HTML management password even if the HTTP interface password was changed, potentially granting remote attackers unauthorized access. No exploitation details are provided in the connected documents.

CVE-2004-0680

Zoom X3 ADSL modem has a terminal running on port 254 that can be accessed using the default HTML management password, even if the password has been changed for the HTTP interface, which could allow remote attackers to gain unauthorized access...

CVE-2003-1442

The web administration page for the Ericsson HM220dp ADSL modem does not require authentication, which could allow remote attackers to gain access from the LAN side...

Speedtouch 510 DOS

Speedtouch 510 ADSL Modem/FW/Router We have been attempting to run NMAP and NESSUS scans using a new ADSL cable link. Using the ADSL modem mentioned above, we found that a standard NMAP/NESSUS scan of an IP range would force the router to reboot itself after 20 seconds. Thinking this was faulty...

Thomnson TCM315 Denial of service

. : Shell Security Advisory : . Subject: Buffer overflow in the cable modem Thomson TCM315 Issue date: 2003 November 23 Related link: http://www.shellsec.net/leeradvisory.php?id=2 Homepage: http://www.shellsec.net Info about product: http://www.qb.ro/docs/tcm315.pdf - 1 - Introduction...

Security issues in D-Link DSL-300/DSL-300G+ Broadband Modem/Router

Arhont Ltd - Information Security Company Arhont Advisory by: Andrei Mikhailovsky www.arhont.com Advisory: D-Link DSL Broadband Modem/Router Router Model Name: D-Link DSL-300G/DSL-300G+ Model Specific: Other models might be vulnerable as well Manufacturer site: http://www.dlink.com Manufacturer...

D-Link DSL Broadband Modem SNMP Cleartext ISP Credential Disclosure

This script uses SNMP to obtain the account and password of the remote ADSL connection. D-Link DSL Broadband routers uses a default community string and stores the ISP credentials in cleartext. C Tenable Network Security, Inc. Ref: Date: 27 Mar 2003 15:31:41 -0000 From: Arhont Information Securit...

Ericsson HM220dp DSL Modem - World Accessible Web Administration Interface

Ericsson HM220dp DSL Modem - World Accessible Web Administration Interface source: https://www.securityfocus.com/bid/6824/info The Ericsson HM220dp DSL Modem uses a web interface for remote administration and configuration. This interface does not require any authentication in order to access...

CVE-2002-2380

NetDSL ADSL Modem 800 with Microsoft Network firmware 5.5.11 allows remote attackers to gain access to configuration menus by sniffing undocumented usernames and passwords from network traffic...

CVE-2002-2112

RCA Digital Cable Modem DCM225 and DCM225E, and other modems that must conform to the Data-over-Cable Service Interface Specifications DOCSIS standard, uses the "public" community string for SNMP access, which allows remote attackers to read or write MIB information...

CVE-2002-1968

Com21 DOXport 1100 series cable modem running firmware 2.1.1.106, and possibly other versions before 2.1.1.108.003, downloads a DOCSIS configuration file from a TFTP server running on the internal network, which allows local users to modify configuration of the modem via a malicious TFTP server...

Motorola Cable Modem DOS

I've found it trivial to crash the Motorola Surfboard 4200 Cable modem, as installed default by AT&T Broadband Internet. The modem acts as a bridge, but also has an internal RFC1918 IP address 192.168.100.1. Simply nmap'ing the cable user's IP address, ie: nmap -sS -p 1-1024 12.x.x.x will cause i...

asciiSECURE advisory (2002-07-17/1)

ASCII HEADER ADVISORY !! ALERT !! ASCII HEADER ADVISORY !! ALERT !! ASCII HE :::::::: ADDIUNG A POORLY GENERATED ASCII HEADERZ FOR BUGTACKY READERZAAZSZ! :::::apparentlytheonlywaytogetamessageacceptedonbugtraqistodothis::::::::::: :::GREETZ2MOIher0z...mali/malificient/the mali amazing san fran...

Cable Modem Termination System Authentication Bypass

...

CVE-2002-0119

The CVE-2002-0119 entry concerns the Alcatel Speed Touch Home ADSL Modem. The vulnerability is triggered by remote network scanning using unusual packets (e.g., Nmap with OS detection), which leads to a denial of service (reboot). The NVD entry lists a network-based attack vector with low complex...

CVE-2002-0119

Alcatel Speed Touch Home ADSL Modem allows remote attackers to cause a denial of service reboot via a network scan with unusual packets, such as nmap with OS detection...

CVE-1999-1301

The CVE-1999-1301 issue concerns the rzsz implementation of the Z-Modem protocol in FreeBSD prior to 2.1.5. A design flaw in the Z-Modem handling allows the remote sender of a file to execute arbitrary programs on the client, constituting remote code execution at the client side. Affected compone...

CVE-1999-1301

A design flaw in the Z-Modem protocol allows the remote sender of a file to execute arbitrary programs on the client, as implemented in rz in the rzsz module of FreeBSD before 2.1.5, and possibly other programs...

efax

Didn't see this mentioned before... hdm@sliver: which efax /opt/kde2/bin/efax hdm@sliver: ls -la /opt/kde2/bin/efax -rwsr-xr-x 1 root root 96689 Aug 16 10:23 /opt/kde2/bin/efax hdm@sliver: efax -h efax: Tue Jan 15 18:43:28 2002 efax v 0.9a-001114 Copyright 1999 Ed Casas efax: Tue Jan 15 18:43:28...