[NEWS] Siemens Santis 50 Information Disclosure

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Siemens Santis 50 Information Disclosure
------------------------------------------------------------------------


SUMMARY

"The Siemens Santis 50 Wireless router is a wi-fi (802.11b) ADSL router. 
It's a complete system for home and small business networks in a single 
device."

A special reset request for the Siemens SANTIS 50 router allows attackers 
to retrieve information from the router.

DETAILS

Vulnerable Systems:
 * Siemens SANTIS 50 with firmware 4.2.8.0
 * Ericsson HN294dp with firmware 4.2.8.0 (OEM version)
 * Dynalink RTA300W with firmware 4.2.8.0 (OEM version)

The mentioned routers provides a web management interface and the classic 
telnet CLI for administration purposes. By default these services are 
available only from the local network, but can be optionally activated 
also on the WAN interface.

Sending a trigger packet to the management port (280/http-mgmt) can be 
used to "freezes" the web interface, which in turn allows unauthenticated 
connection with the telnet CLI.

This behavior appears to be some sort of "disaster recovery mode". The set 
of available commands is limited to a few, but they are enough to allow 
attackers to discover information about the configuration of the device 
and its connections (events, traffic, Ethernet addresses configuration, 
etc). In addition, a command that allows to "irreversibly erase FLASH 
contents" is made available.

Proof of Concept:
A simple exploit is to use the application scanner AMAP to scan the remote 
host's web port causing it to freeze.


ADDITIONAL INFORMATION

The information has been provided by  
<mailto:luca.carettoni@xxxxxxxxxxxxxxxx> luca.carettoni.
The original article can be found at:  
<http://www.securenetwork.it/advisories/> 
http://www.securenetwork.it/advisories/



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.