[Commotion-admin] [olsrd] OLSRd Provides Network Exposed Attack Surface (#7)

[areynold]

**FINDING ID:** iSEC-COMMO13-9

**TARGETS:** OLSRd daemons listening on all interfaces and running as the root user:
* http://192.168.1.20:1978/
* http://192.168.1.20:9090/
* http://192.168.1.20:2006/

**DESCRIPTION:** The services listed above provide unauthenticated access to sensitive internal state of the OLSRd daemon. These daemons also expose HTTP interfaces and run as the root user. This attack surface and information is accessible to unauthenticated users (who are able to gain access to the network). If they are not required for end use, they should be listening only on localhost, disabled or firewalled.

**EXPLOIT SCENARIO:** An attacker connects to the public wireless interface running on a commotion router. He port scans the router and discovers the above services. He downloads the OLSRd configuration and uses the information contained within to perform directed attacks.

**SHORT TERM SOLUTION:** Disable the above services.
**LONG TERM SOLUTION:** Configure an end-host firewall to block access to all ports except those explicitly required for functionality. Port scan routers as a part of a regression test to identify wayward services that have been left running.

---
Reply to this email directly or view it on GitHub:
https://github.com/opentechinstitute/olsrd/issues/7
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.chambana.net/pipermail/commotion-admin/attachments/20130911/8292efb2/attachment.html>