|
Brought to you by:
Suppliers of:
|
|
|
| |
| The NETGEAR FM114P is a hub, printer server, wireless access point, firewall, and IDS. The firewalling module also supports filtering for domain names (e.g. "www.computec.ch"). This module has been found to not translate IP addresses into domain names, allowing someone to access a restricted domain name by using its IP equivalent. |
| |
Credit:
The information has been provided by Marc Ruef.
|
| |
Vulnerable systems:
* NETGEAR FM114P firmware version 1.0
* NETGEAR FM114P firmware version 1.3 Release 04
Due to this flaw, a user may access a site by entering the IP address instead of the host and domain name.
A possible workaround is to add the IP address(es) of the forbidden hostname in the blacklist (e.g. "195.65.88.12"). However, do not forget that some smart attackers could use dot-less IP addresses (e.g. "http://3275839500"). In addition, you will get some problems with virtual hosting web servers. In addition, every additional filter entry will slow down the FM114P.
Vendor response:
Marc has informed the vendor on 02/09/05 with an email to support@NETGEAR.com - The following message came back two days later (very nice responding time):
You've probably already noticed that the router is not designed to block sites by IP address -- only by keyword -- This is *not* a vulnerability, just not something the router was designed to do -- Taken from the FM114P Reference Manual: "Content Filtering With its content filtering feature, the NETGEAR ProSafe Firewall prevents objectionable content from reaching your PCs. The firewall allows you to control access to Internet content by screening for keywords within Web addresses. You can configure the firewall to log and report attempts to access objectionable Internet sites.
Content filtering with its content filtering feature, the NETGEAR ProSafe Firewall prevents objectionable content from reaching your PCs. The firewall allows you to control access to Internet content by screening for keywords within Web addresses. You can configure the firewall to log and report attempts to access objectionable Internet sites."
"The NETGEAR ProSafe Firewall allows you to restrict access based on Web addresses and Web address keywords. Up to 255 entries are supported in the Keyword list. The Keyword Blocking menu is shown in Figure 5-2:"
As for IP address blocking being added to future firmware revisions, you'll be able to request it at this link (which will be read by NETGEAR's Engineers) -- http://www.expressresponse.com/NETGEAR1/feedbackmenu.html
|
|
|
|
|
