----------------------------------------------------------------------

Want to join the Secunia Security Team?

Secunia offers a position as a security specialist, where your daily
work involves reverse engineering of software and exploit code,
auditing of source code, and analysis of vulnerability reports.

http://secunia.com/secunia_security_specialist/

----------------------------------------------------------------------

TITLE:
D-Link DWL-2100AP Exposure of Configuration Files

SECUNIA ADVISORY ID:
SA20474

VERIFY ADVISORY:
http://secunia.com/advisories/20474/

CRITICAL:
Less critical

IMPACT:
Exposure of sensitive information

WHERE:
>From local network

OPERATING SYSTEM:
D-Link DWL-2100AP
http://secunia.com/product/4116/

DESCRIPTION:
A security issue has been reported in D-Link DWL-2100AP, which can be
exploited by malicious people to disclose sensitive information.

The problem is caused due to configuration files being stored
insecurely inside the "cgi-bin" directory. This can be exploited to
disclose the administrator's username and password, and other device
configuration information without being authenticated by requesting
the configuration file directly via the web interface.

Example:
http://[host]/cgi-bin/[file].cfg

The security issue has been reported in firmware version 2.10na.
Other versions may also be affected.

SOLUTION:
Filter traffic to the web interface of an affected device.

PROVIDED AND/OR DISCOVERED BY:
Wendel Guglielmetti Henrique and Intruders Tiger Team Security.

ORIGINAL ADVISORY:
http://www.intruders.org.br/adv0206en.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------