From idlabs-advisories@idefense.com Thu Aug 5 17:00:57 2004 From: idlabs-advisories@idefense.com To: idlabs-advisories@idefense.com Date: Thu, 5 Aug 2004 15:21:59 -0400 Reply-To: customerservice@idefense.com Subject: [Full-Disclosure] iDEFENSE Security Advisory 08.05.04: Thompson SpeedTouch Home ADSL Modem Predictable TCP ISN Generation Thompson SpeedTouch Home ADSL Modem Predictable TCP ISN Generation iDEFENSE Security Advisory 08.05.04 www.idefense.com/application/poi/display?id=120&type=vulnerabilities August 5, 2004 I. BACKGROUND The Thompson (formerly Alcatel) SpeedTouch is an ADSL router for home and business providing a continuously available, "always on," connection. More information about the product can be found at http://www.speedtouchdsl.com/. II. DESCRIPTION Remote exploitation of a design error vulnerability in Thompson's SpeedTouch Home ADSL modem allows attackers to spoof TCP traffic on behalf of the device. The problem specifically exists due to the predictable nature of the TCP Initial Sequence Number (ISN) generator on the device. The following sanitized tcpdump output demonstrates the existence of the vulnerability when 10 consecutive TCP connection requests are generated for the telnet server (port 23) on the Thompson device: 48.3 host_a.1096 > host_b.telnet: S 48.3 host_b.telnet > host_a.1096: S 4081040897:4081040897(0) ack 48.3 host_a.1096 > host_b.telnet: R 48.4 host_a.1096 > host_b.telnet: S 48.4 host_b.telnet > host_a.1096: S 4081104897:4081104897(0) ack 48.4 host_a.1096 > host_b.telnet: R 48.6 host_a.1096 > host_b.telnet: S 48.6 host_b.telnet > host_a.1096: S 4081232897:4081232897(0) ack 48.6 host_a.1096 > host_b.telnet: R 48.7 host_a.1096 > host_b.telnet: S 48.7 host_b.telnet > host_a.1096: S 4081296897:4081296897(0) ack 48.7 host_a.1096 > host_b.telnet: R 48.9 host_a.1096 > host_b.telnet: S 48.9 host_b.telnet > host_a.1096: S 4081360897:4081360897(0) ack 48.9 host_a.1096 > host_b.telnet: R 49.0 host_a.1096 > host_b.telnet: S 49.0 host_b.telnet > host_a.1096: S 4081488897:4081488897(0) ack 49.0 host_a.1096 > host_b.telnet: R 49.2 host_a.1096 > host_b.telnet: S 49.2 host_b.telnet > host_a.1096: S 4081552897:4081552897(0) ack 49.2 host_a.1096 > host_b.telnet: R 49.3 host_a.1096 > host_b.telnet: S 49.3 host_b.telnet > host_a.1096: S 4081616897:4081616897(0) ack 49.3 host_a.1096 > host_b.telnet: R 49.5 host_a.1096 > host_b.telnet: S 49.5 host_b.telnet > host_a.1096: S 4081744897:4081744897(0) ack 49.5 host_a.1096 > host_b.telnet: R 49.6 host_a.1096 > host_b.telnet: S 49.6 host_b.telnet > host_a.1096: S 4081808897:4081808897(0) ack 49.6 host_a.1096 > host_b.telnet: R In the above example, host_a is the querying host and host_b is the Thompson device. A clear pattern in ISN generation can be seen as the value increases by approximately 64,000 each millisecond. III. ANALYSIS Successful exploitation of weak ISNs for the purpose of connection spoofing is not a trivial task. Successful exploitation allows an attacker to generate traffic on behalf of the affected device. Such an ability is most dangerous when trust paths exist between the affected device and another remote system. IV. DETECTION iDEFENSE has verified the existence of this vulnerability in Thompson's SpeedTouch firmware version GV8BAA3.270 (1003825). It is suspected that earlier versions are susceptible to exploitation as well. V. WORKAROUNDS Untrusted traffic should be filtered at the network perimeter. VI. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2004-0641 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VII. DISCLOSURE TIMELINE 06/08/04 Initial vendor contact - no response 06/08/04 iDEFENSE clients notified 06/18/04 Secondary vendor contact - no response 08/05/04 Public disclosure VIII. CREDIT The discoverer wishes to remain anonymous. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp IX. LEGAL NOTICES Copyright (c) 2004 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html