DHCP: HTML Tags in DHCP Request

This signature detects HTML tags embedded in the HOSTNAME field of a DHCP request. Attackers can use this technique to force the administrators of some DHCP servers to execute code when viewing logs with a HTML-parsing viewer.

Extended Description

It is reported that the DI-614+, DI-704, and the DI-624 are susceptible to an HTML injection vulnerability in their DHCP log. An attacker who has access to the wireless, or internal network segments of the router can craft malicious DHCP hostnames, that when sent to the router, will be logged for later viewing by the administrator of the device. The injected HTML can be used to cause the administrator to make unintended changes to the configuration of the router. Other attacks may be possible. Although only the DI-614+, DI-704, and the DI-624 are reported vulnerable, code reuse across devices is common and other products may also be affected.

Affected Products

D-link di-624_soho_router

References

BugTraq: 10587

CVE: CVE-2004-0615

URL: http://securityfocus.com/archive/1/366615/2004-06-21/2004-06-27/0

Short Name

DHCP:EXPLOIT:HOSTNAME-HTML

Severity

Minor

Recommended

False

Recommended Action

None

DHCP: HTML Tags in DHCP Request

Extended Description

Affected Products

References

Found a potential security threat?