[ http://www.rootshell.com/ ]

Date: Wed, 10 Feb 1999 22:10:57 +0100
From: Pascal Gienger <p@ZNET.DE>
Subject: Security Bug in Bintec Router Firmware (CLID)

Vulnerability in Bintec Firmware BOSS V4.9 Release 1 and earlier

Abstract:
Non-interpretation of "international" or "national" incoming call setup
leads to a security problem when you accept connections based on their
incoming call number.

Bintec is a manufacturer of routers whose market share is growing steadily.
So the following information should be of general interest.
Bintec Routers are shipped with the BOSS Operating system, current release
is V4.9, Rel.3.

Bricks do support besides PPP links also raw IP encapsulation over HDLC
frames (ISDN Line).
In the latter case, WAN partner are distinguished based upon their incoming
call number (CLID), so you must "trust" your telephone company for issuing
the right information. People may set their own "outgoing" number, but only
the ones marked as "screened" by the telco are looked at.

In Germany, you have to dial an "0" to exit your local area, and "00" to
access international calls. These zeros, however, do not belong to the
real telephone number, they are not passed along with the ISDN call request.
So a call from +41 1 1234567 (0041 1 1234567) is passed as "4111234567".
A call from 0411 1234567 (national call from city zone "4111") is
also passed as "4111234567". You have to set this "4111234567" as an
incoming number in the brick setup because otherwise the Brick would
not recognize the call.
The only difference is a flag which says whether the call is an international
one or not.

BOSS does not distinguish these two, leaving this security hole open. If you
know the number of a WAN partner abroad which number has less than 9
digits, you can search the local zone in Germany and trying to get there
the appropriate number to access the router. Might be complicated, but if
you know that there is sensitive stuff to get...

A possible fix would be to always insist on a form like "49411123456789" for
the national german call (with leading international prefix).

I wrote a notice to Bintec 24h ago, but I got no response until now.
I'll tell their answer as soon as I'll get it.

I would not be surprised to hear that other router firmwares are acting in
the same way...

Pascal
--
Unix,   Pascal Gienger, Moosstr. 7 /\ 7 .rtssooM ,regneiG lacsaP    xinU
Networx 78467 Konstanz, p@znet.de /  \ ed.tenz@p ,znatsnoK 76487 xrowteN
& WWW       http://pascal.znet.de/    \ed.tenz.lacsap\\:ptth       WWW &
        http://echo.znet.de:8888/ echo \8888:ed.tenz.ohce\\:ptth