Vulnerabilities 2008

PR08-24 Proxim Tsunami MP.11 2411 vulnerable to SNMP Injection

• Advisory publicly released: Thursday, 9 October 2008
• Vulnerability found: Friday, 2 May 2008
• Vendor informed: Friday, 2 May 2008
  also informed in 1 August 2008, cause of no response received.
• Vulnerability fixed: no response was received from the vendor. A workaround has been included in the "Fix" section.
• Severity level: High

• Credits
  Adrian Pastor of ProCheckUp Ltd
• Description
  Attackers can inject a malicious HTML/JavaScript payload via the "system.sysName.0" SNMP OID. Such payload is returned on the web interface when the administrator user views pages such as '/config/configure-systems.html'. The injected code can perform any actions within the context of the current session (full administrative rights).
  
  Although usually the SNMP write community string must be guessed/cracked for a SNMP injection [1] attack to work, some embedded devices come with SNMP read/write access enabled by default. Some examples include many ZyXEL Prestige router models [2] used in residential and SOHO networks, and also products used in corporate and government environments such as the Proxim Tsunami MP.11 2411 Wireless Point-to-Multipoint System.
  
  From Proxim Tsunami MP.11 2411's user manual:
  
  "
  SNMP Read/Write Community Password
  The password for read and write access to the MP.11/MP.11a using SNMP. Enter a password in both the Password field and the Confirm field. The default password is public.
  "
• Proof of concept
  $ snmpset -v1 -c public 192.168.1.100 sysName.0 s '"><script>alert(1)</script>'
• How to fix
  Disable SNMP write access. If SNMP write access is absolutely needed, change the default read/write community string from "public" to a non-predictable and hard-to-crack value.
• Successfully tested on
  Tsunami MP.11 2411 Wireless Point-to-Multipoint System
  Wireless Router v- v1.0.0 Bld#24 SN-03AT15620395 v3.0.3
  
  Note: make/model and firmware version were obtained via the iso.org.dod.internet.mgmt.mib-2.system.sysDescr.0 SNMP OID.
• BID
  31666
• References
  

  [1] "SNMP Joins Dark Side in New XSS Attack"
  http://www.darkreading.com/document.asp?doc_id=147014

  [2] "ZyXEL Gateways Vulnerability Research" (See section 2.3 Persistent XSS via SNMP)
  http://www.procheckup.com/research/documents/4

  Tsunami MP.11 Model 2411 and Model 5054:
  http://www.proxim.com/learn/library/datasheets/mp11_a4.pdf

  ProCheckUp Security Vulnerabilities and Advisories:
  http://www.procheckup.com/research/views/vulnerabilities

  
  
• Legal
  Copyright 2008 Procheckup Ltd. All rights reserved.
  
  Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to Procheckup, and provided such reproduction and/or distribution is performed for non-commercial purposes.
  
  Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party.