Sign-up

ID

VAR-200408-0052


CVE

CVE-2004-0641


TITLE

Thomson SpeedTouch Home ADSL Modem predictable TCP Serial number vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200408-015

DESCRIPTION

Thomson SpeedTouch 510 ADSL Router with firmware GV8BAA3.270, and possibly earlier versions, generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections. The ability to predict TCP sequence numbers may allow a remote attacker to inject packets into a vulnerable data stream, for example the telnet service on the affected modem. Remote attackers can use this vulnerability to carry out TCP communication forgery attacks. The TCP initialization sequence number of the device can be guessed, which can cause the attacker to fail the ADSL Modem communication by forging the communication, or hijack the device. BACKGROUND The Thompson (formerly Alcatel) SpeedTouch is an ADSL router for home and business providing a continuously available, "always on," connection. More information about the product can be found at http://www.speedtouchdsl.com/. II. The problem specifically exists due to the predictable nature of the TCP Initial Sequence Number (ISN) generator on the device. The following sanitized tcpdump output demonstrates the existence of the vulnerability when 10 consecutive TCP connection requests are generated for the telnet server (port 23) on the Thompson device: 48.3 host_a.1096 > host_b.telnet: S 48.3 host_b.telnet > host_a.1096: S 4081040897:4081040897(0) ack 48.3 host_a.1096 > host_b.telnet: R 48.4 host_a.1096 > host_b.telnet: S 48.4 host_b.telnet > host_a.1096: S 4081104897:4081104897(0) ack 48.4 host_a.1096 > host_b.telnet: R 48.6 host_a.1096 > host_b.telnet: S 48.6 host_b.telnet > host_a.1096: S 4081232897:4081232897(0) ack 48.6 host_a.1096 > host_b.telnet: R 48.7 host_a.1096 > host_b.telnet: S 48.7 host_b.telnet > host_a.1096: S 4081296897:4081296897(0) ack 48.7 host_a.1096 > host_b.telnet: R 48.9 host_a.1096 > host_b.telnet: S 48.9 host_b.telnet > host_a.1096: S 4081360897:4081360897(0) ack 48.9 host_a.1096 > host_b.telnet: R 49.0 host_a.1096 > host_b.telnet: S 49.0 host_b.telnet > host_a.1096: S 4081488897:4081488897(0) ack 49.0 host_a.1096 > host_b.telnet: R 49.2 host_a.1096 > host_b.telnet: S 49.2 host_b.telnet > host_a.1096: S 4081552897:4081552897(0) ack 49.2 host_a.1096 > host_b.telnet: R 49.3 host_a.1096 > host_b.telnet: S 49.3 host_b.telnet > host_a.1096: S 4081616897:4081616897(0) ack 49.3 host_a.1096 > host_b.telnet: R 49.5 host_a.1096 > host_b.telnet: S 49.5 host_b.telnet > host_a.1096: S 4081744897:4081744897(0) ack 49.5 host_a.1096 > host_b.telnet: R 49.6 host_a.1096 > host_b.telnet: S 49.6 host_b.telnet > host_a.1096: S 4081808897:4081808897(0) ack 49.6 host_a.1096 > host_b.telnet: R In the above example, host_a is the querying host and host_b is the Thompson device. A clear pattern in ISN generation can be seen as the value increases by approximately 64,000 each millisecond. III. ANALYSIS Successful exploitation of weak ISNs for the purpose of connection spoofing is not a trivial task. Successful exploitation allows an attacker to generate traffic on behalf of the affected device. Such an ability is most dangerous when trust paths exist between the affected device and another remote system. IV. DETECTION iDEFENSE has verified the existence of this vulnerability in Thompson's SpeedTouch firmware version GV8BAA3.270 (1003825). It is suspected that earlier versions are susceptible to exploitation as well. V. WORKAROUNDS Untrusted traffic should be filtered at the network perimeter. VI. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2004-0641 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VII. DISCLOSURE TIMELINE 06/08/04 Initial vendor contact - no response 06/08/04 iDEFENSE clients notified 06/18/04 Secondary vendor contact - no response 08/05/04 Public disclosure VIII. CREDIT The discoverer wishes to remain anonymous. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp IX. LEGAL NOTICES Copyright © 2004 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information

Trust: 1.35

sources: NVD: CVE-2004-0641 // BID: 10881 // VULHUB: VHN-9071 // PACKETSTORM: 33975

AFFECTED PRODUCTS

vendor:thomsonmodel:speedtouchscope:eqversion:510_adsl_router

Trust: 1.6

vendor:thomsonmodel:speedtouch adsl routerscope:eqversion:510

Trust: 0.3

sources: BID: 10881 // CNNVD: CNNVD-200408-015 // NVD: CVE-2004-0641

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2004-0641
value: HIGH

Trust: 1.0

CNNVD: CNNVD-200408-015
value: HIGH

Trust: 0.6

VULHUB: VHN-9071
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2004-0641
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-9071
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-9071 // CNNVD: CNNVD-200408-015 // NVD: CVE-2004-0641

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2004-0641

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 33975 // CNNVD: CNNVD-200408-015

TYPE

Design Error

Trust: 0.9

sources: BID: 10881 // CNNVD: CNNVD-200408-015

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-9071

EXTERNAL IDS
db:NVDid:CVE-2004-0641
Trust: 2.1
db:BIDid:10881
Trust: 2.0
db:SECUNIAid:12238
Trust: 1.7
db:AUSCERTid:ESB-2004.0504
Trust: 1.7
db:CNNVDid:CNNVD-200408-015
Trust: 0.7
db:IDEFENSEid:20040805 THOMPSON SPEEDTOUCH HOME ADSL MODEM PREDICTABLE TCP ISN GENERATION
Trust: 0.6
db:XFid:16919
Trust: 0.6
db:PACKETSTORMid:33975
Trust: 0.2
db:EXPLOIT-DBid:19522
Trust: 0.1
db:VULHUBid:VHN-9071
Trust: 0.1
sources:
            
            
            VULHUB: VHN-9071 // 
            
            
            
            BID: 10881 // 
            
            
            
            PACKETSTORM: 33975 // 
            
            
            
            CNNVD: CNNVD-200408-015 // 
            
            
            
            NVD: CVE-2004-0641

REFERENCES
url:http://www.auscert.org.au/render.html?it=4299
Trust: 1.7
url:http://www.securityfocus.com/bid/10881
Trust: 1.7
url:http://secunia.com/advisories/12238/
Trust: 1.7
url:http://www.idefense.com/application/poi/display?id=120&type=vulnerabilities&flashstatus=true
Trust: 1.6
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/16919
Trust: 1.1
url:http://xforce.iss.net/xforce/xfdb/16919
Trust: 0.6
url:http://www.idefense.com/application/poi/display?id=120&type=vulnerabilities
Trust: 0.3
url:http://www.speedtouch.com/
Trust: 0.3
url:http://www.idefense.com/application/poi/display?id=120&type=vulnerabilities&flashstatus=true
Trust: 0.1
url:http://cve.mitre.org),
Trust: 0.1
url:http://www.idefense.com/poi/teams/vcp.jsp
Trust: 0.1
url:http://www.speedtouchdsl.com/.
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2004-0641
Trust: 0.1
sources:
            
            
            VULHUB: VHN-9071 // 
            
            
            
            BID: 10881 // 
            
            
            
            PACKETSTORM: 33975 // 
            
            
            
            CNNVD: CNNVD-200408-015 // 
            
            
            
            NVD: CVE-2004-0641

CREDITS
iDEFENSE
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200408-015

SOURCES
db:VULHUBid:VHN-9071
db:BIDid:10881
db:PACKETSTORMid:33975
db:CNNVDid:CNNVD-200408-015
db:NVDid:CVE-2004-0641

LAST UPDATE DATE
2024-08-14T12:04:46.853000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-9071date:2017-07-11T00:00:00
db:BIDid:10881date:2009-07-12T06:16:00
db:CNNVDid:CNNVD-200408-015date:2005-10-20T00:00:00
db:NVDid:CVE-2004-0641date:2017-07-11T01:30:20.197

SOURCES RELEASE DATE
db:VULHUBid:VHN-9071date:2004-08-05T00:00:00
db:BIDid:10881date:2004-08-05T00:00:00
db:PACKETSTORMid:33975date:2004-08-06T18:58:41
db:CNNVDid:CNNVD-200408-015date:2004-08-05T00:00:00
db:NVDid:CVE-2004-0641date:2004-08-05T04:00:00