Signature Detail
Short Name |
DHCP:EXPLOIT:HOSTNAME-HTML |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
DHCP |
Keywords |
HTML Tags in DHCP Request |
Release Date |
2004/10/20 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
DHCP: HTML Tags in DHCP Request
This signature detects HTML tags embedded in the HOSTNAME field of a DHCP request. Attackers can use this technique to force the administrators of some DHCP servers to execute code when viewing logs with a HTML-parsing viewer.
Extended Description
It is reported that the DI-614+, DI-704, and the DI-624 are susceptible to an HTML injection vulnerability in their DHCP log. An attacker who has access to the wireless, or internal network segments of the router can craft malicious DHCP hostnames, that when sent to the router, will be logged for later viewing by the administrator of the device. The injected HTML can be used to cause the administrator to make unintended changes to the configuration of the router. Other attacks may be possible. Although only the DI-614+, DI-704, and the DI-624 are reported vulnerable, code reuse across devices is common and other products may also be affected.
Affected Products
- D-Link DI-614+ 2.0.0
- D-Link DI-614+ 2.0.0 3
- D-Link DI-614+ 2.0.0 3g
- D-Link DI-614+ 2.0.0 f
- D-Link DI-614+ 2.10.0
- D-Link DI-614+ 2.18.0
- D-Link DI-624 SOHO Router 1.28.0
- D-Link Dl-704 2.56.0 b5
- D-Link Dl-704 2.56.0 b6
- D-Link Dl-704 2.60.0 b2
References
- BugTraq: 10587
- CVE: CVE-2004-0615
- URL: http://securityfocus.com/archive/1/366615/2004-06-21/2004-06-27/0