"fun; i keep waiting for these vulns to get old, but it's just still funny, every time!"
And seems to me that not all XSS vulnerabilities are being dealt with in an extensive manner. So, albeit dealing with this specific vulnerability in 5 days, looks like ASUS is dealing with XSS vulnerabilities on a one-by-one methodology... So I believe there are more XSS vulnerabilities to be discovered in that same web management interface. On Sun, Apr 6, 2014 at 7:00 AM, coderman <[email protected]> wrote: > On Fri, Apr 4, 2014 at 11:08 AM, Palula Brasil <[email protected]> wrote: >>... >> Reflected Cross-Site Scripting within the ASUS RT-AC68U Managing Web >> Interface >> ... >> * Impact: This vulnerability allows for performing attacks against third >> party >> users of the ASUS RT-AC68U web management platform, by luring them >> into clicking on a link provided with malicious content, which in >> turn, will execute on the context of the victim's browser. > > fun; i keep waiting for these vulns to get old, but it's just still > funny, every time! > > best regards, > > > > p.s. see also: "How I Hacked Your Router" > http://disconnected.io/2014/03/18/how-i-hacked-your-router/ > > "Security Flaws in Universal Plug and Play: Unplug, Don't Play" > > https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play > > "DNS Cache Poisoning Issue ("Kaminsky bug") (CVE-2008-1447)" > > these tales of woe go on in consumer internet of buggy things -i-verse > for eons. thus i need say no more. *grin* > > > > more of this story: try to break your hardware before it gets broken; > if you can't make it not break under known methods, build/install > something better! [you can install Tomato on a RT-AC68U with > functional Tor transproxy and administration via ssh only, as just one > example.] -- Palula Brasil palulabrasil*SPAM*gmail.com 24E5 3ED3 E77C F868 805D F843 E156 6DB8 49FB 8B40 _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
