Date: Tue, 11 Aug 1998 20:35:20 -0700 From: Jason Ackley Subject: DoS in Flowpoint 2000 DSL routers Hello, Quick Overview: There exists a DoS in Flowpoint's (A)DSL 2000 router ('fp2k') running software rev 1.2.3 (anyone have other revs to test?) Lil Backgrounder: Flowpoint builds the routers and distributes them through various OEMs and VARs, one that I know of is Diamond Lane Commuications, so if you have a DSL router its best to take a peak at it real quick(tm). Basically its not much bigger than a modem, has six blinky lights on the front. Vendor Status: I informed Flowpoint of this problem on Fri May 29, Flowpoint responded on Mon Jun 1 with a fix and an apology for not responding to me sooner! Quick Service! Gory Details: Like most routers the fp2k will allow you to telnet into it for monitoring/ testing / admin functions. One problem exists in that the fp2k does not allow you to (as of firmware 1.4.1) configure a telnet password, only a system password (sort of like 'enable') to change things. It also allows you to change the telnet port that it listens on , but that seems a little too much 'security through obscurity' for me. Once you telnet into the fp2k you are presented with something like: FlowPoint/2000 ADSL Router v1.2.3 Ready > Once you 'are in' , you can do a few basic things, in order to edit things, you can use the 'login' command followed by the password, such as: > login foobar Logged in successfully! # The problem happens when you do something like: >login At this point, you will not get the prompt back (if you did it right :) ), and on the serial console , you may get something like: TCP: trim 13 bytes from the front! With the 13 ranging from 1 as high as 976 from my few tests.. There is obviously some problems in the way it handles its buffers.. The mem command reports %99 of the small buffers in use: >mem Small buffers used....... 254 (99% of 256 used) Large buffers used....... 52 (20% of 256 used) If you close the telnet connection and try again, you may get something like this on the console: NOTIFIER: no mem: TCP: lvl=9: c=0: sc=0: e=0 another incoming connection ignored for now SNMP read attempts will get the first few OID objects, then start errors on the serial port of: SNMPD: TX: err: allocate packet buffer! SNMPD: TX: err: allocate packet buffer! At this point, serial communications gets interrupted (it must be waiting on a small buffer to get freed up) As typing commands will not do anything, you have to type them a few times (and hopefully get the buffer before something else does) A ps reveals that my old telnet is still active: > TID: NAME FL P BOTTOM CURRENT SIZE 1:IDLE 02 7 12f9f0 130100 2032 18:TN [170.1.68.2:4658] 03 6 130220 131070 4080 3:MSFS_SYNC 03 6 1314a0 131ba0 2032 4:SYSTEM LOGGER 03 5 131cd0 1323d0 2032 5:LL_PPP 03 5 135620 135d20 2032 6:NL_IP 03 5 135f10 136208 1000 7:TL_IP_UDP 03 3 136390 136690 1000 8:TL_IP_TCP 03 3 1367f0 136ef8 2032 9:IP_RIP 03 4 137050 137348 1000 10:TELNETD 03 5 137480 137760 1000 11:BOOTP 03 5 13a590 13a878 1000 12:DUM 03 5 13ad10 13b410 2032 13:ADSL 03 1 13b560 13bc28 2032 14:SNMPD 03 5 133b40 134a48 4080 15:CMD 01 6 13c0c0 13cf10 4080 > I then started some heavy internet traffic, of a ftp session and surfing the web a bit. After which the serial port becomes frozen, but it still displays the NOTIFER message and SNMPD error messages when you try to do something. I did not do too many bandwidth tests as I was in the mood to get it fixed more than anything else.. After a power cycle, the box is back to itself again. Fix: If your box becomes like this, you can powercycle it and it is back to normal. As I mentioned , Flowpoint provided a fix the next business day, so you should upgrade your firmware, v1.4.1 is the 'fixed' version they gave me, v1.4.3 is the latest AFAIK. Contact Flowpoint or the OEM label that yours has stamped on it for more infoormation regarding upgrading firmware. Scripts for the kids? Nope. Roll your own. Sorta remind me of the Cisco 760 problem a while back. cheers, ----- Jason "jBot" Ackley