[MLB-WIRELESS] Dlink 900+ firmware v2.3

[Rowan Crowe]

On Thu, 7 Nov 2002, Tyson Clugg wrote:

> > >
> ftp://ftp.dlink.com/Wireless/DWL900AP+/Firmware/dwl900AP+_firmware_230.exe
> > >
> > > Not sure if it fixes the recent security flaw, but it's firmware dated
> 29
> > > Sept 2002.
> > > Tested it on mine.... looks good so far...
> >
> > Firstly - what security flaw? :) I purchased one of these units yesterday.
> 
> Sending a broadcast packet to UDP port 27155 containing the string
> "gstsearch" causes the accesspoint to return wep keys, mac filter and
> admin password. This happens on the WLAN Side and on the LAN Side.

Is this related to the TFTP flaw? I was able to download the raw config
file using a TFTP client - no login or password required. The file
config.img contains the SSID and admin password in clear text.

Just as well that I have only set a temporary password on my AP!

Cheers.


--
Rowan Crowe - Melbourne, Australia
www.camrecord.com  www.camdiscover.com  www.heyasl.com  www.sensationbot.com





To unsubscribe: send mail to majordomo at wireless.org.au
with "unsubscribe melbwireless" in the body of the message