Feeds

BOFH-making bug plugged in D-link update

I'm the king of the... oh

Choosing a cloud hosting partner with confidence

D-Link has plugged a security vulnerability involving protocol handling by some of its wireless routers that creates a potential means for normal users to grab super-user privileges.

The network manufacturer issued a firmware update that addresses a recently discovered bug in how its networking devices handle the Home Network Administration Protocol (HNAP). The flaw meant that the devices offered a shadow connection outside of the regular administrative access channel. This permanent unauthorised connection might be exploited by miscreants to assume admin privileges and change router settings, and might also be used to bypass CAPTCHA login features introduced by D-Link in recent firmware upgrades.

Successful exploitation requires valid login credentials, so the flaw is a privilege elevation risk rather than something more serious. The security shortcoming was found by SourceSec (advisory here (pdf)) and covered by D-Link with an advisory on Monday.

Only some of D-Link's routers are vulnerable. The networking manufacturer issued updates for its DIR-635, DIR-655 and DIR-855 routers.

Discontinued DIR-615, DI-634M and DIR-635 models are also at risk. An update for the DIR-615 is already available, with updates for the DI-653-M and DIR-635 is promised for upcoming weeks.

An (German language) advisory from D-Link explaining the issue in greater detail - along with a list of affected and not-at-risk models and links to firmware patches - can be found here. ®

Beginner's guide to SSL certificates

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.