Security Advisory

IS-2010-005 - D-Link DAP-1160 Authentication Bypass



Advisory Information
--------------------
Published:
2010-06-29

Updated:
2010-06-29

Manufacturer: D-Link
Model: DAP-1160
Firmware version: 1.20b06
          1.30b10
          1.31b01



Vulnerability Details
---------------------

Public References:
Not Assigned


Platform:
Successfully tested on D-Link DAP-1160 loaded with firmware versions:
v120b06, v130b10, v131b01.
Other models and/or firmware versions may be also affected.
Note: Only firmware version major numbers are displayed on the
administration web interface: 1.20, 1.30, 1.31


Background Information:
D-Link DAP-1160 is a wireless access points that allow wireless clients
connectivity to wired networks.
Supported 802.11b and 802.11g protocols. WEP, WPA and WPA2 supported.


Summary:
Administration interface authentication can be bypassed by accessing a
specific URL shortly after device reboot


Details:
Accessing the device web administration interface requires a successful
authentication with proper login credentials.
But if the following URL address:

http://IP_ADDR/tools_firmw.htm

is accessed as a first URL and within a short time (~40 seconds) after
the device web server has started, then no authentication is required to
access device web interface.
The device can then be freely reconfigured and sensitive information can
be extracted and/or modified, such as Wi-Fi SSID and passphrases.
A remote attacker may be able to achieve deterministic authentication
bypass, without waiting for the device to be rebooted, by remotely
rebooting the device via the DCC protocol.
This can be performed in unauthenticated manner, as described in the
advisory "IS-2010-004 - D-Link DAP-1160 Unauthenticated Remote
Configuration"


Impacts:
Remote extraction of sensitive information
Modification of existing device configuration


Solutions & Workaround:
Not available



Additional Information
----------------------
Timeline (dd/mm/yy):
17/02/2010: Vulnerability discovered
17/02/2010: No suitable technical/security contact on Global/Regional
website. No contact available on OSVDB website
18/02/2010: Point of contact requested to customer service
----------- No response -----------
26/05/2010: Vulnerability disclosed at CONFidence 2010
29/06/2010: This advisory


Additional information available at http://www.icysilence.org