Luigi Auriemma has discovered two vulnerabilities in RabidHamster R2 Extreme, which can be exploited by malicious users to disclose potentially sensitive information and compromise a vulnerable system.

1) A boundary error when processing the "File" command can be exploited to cause a stack-based buffer overflow via an overly long parameter sent to TCP port 23.

Successful exploitation of this vulnerability allows execution of arbitrary code, but requires the plugin to be enabled and running (off by default).

2) Input passed to the "File" command within the telnet server is not properly verified before being used to read files and can be exploited to disclose arbitrary files via directory traversal attacks.

NOTE: Additionally, a weakness exists within the telnet server's PIN-based authentication mechanism, which allows to trivially brute force a valid PIN number.

The vulnerabilities are confirmed in version 1.65 Professional. Other versions may also be affected.

Solution
Restrict access to trusted hosts only.

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available in Customer Area

Original Advisory
http://aluigi.altervista.org/adv/r2_1-adv.txt

Deep Links
Links available in Customer Area