from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 54D0B43FB1
	for <jm@localhost>; Mon, 12 Aug 2002 05:49:36 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Mon, 12 Aug 2002 10:49:36 +0100 (IST)
from vikki.vulnwatch.org ([199.233.98.101]) by
    dogma.slashnull.org (8.11.6/8.11.6) with SMTP id g79Ietb20478 for
    <jm@jmason.org>; Fri, 9 Aug 2002 19:40:55 +0100
(qmail 24318 invoked from network); 9 Aug 2002 18:57:50 -0000
Foundstone Labs Advisory - Information Leakage in Orinoco
    and Compaq Access Points
[VulnWatch] Foundstone Labs Advisory - Information Leakage in Orinoco and Compaq Access Points
from quoted-printable to 8bit by dogma.slashnull.org
    id g79Ietb20478
From vulnwatch-return-432-jm=jmason.org@vulnwatch.org  Mon Aug 12 10:49:37 2002

Advisory Name:	Information Leakage in Orinoco and Compaq Access Points
Application:	Orinoco Residential Gateway and Compaq WL310
Severity:	The ability to display/modify configuration information
An information leakage vulnerability exists in Orinoco and Compaq OEM
access points, disclosing the unique SNMP community string. As a result,
an attacker can query the community string and gain the ability to
system configuration including Wired Equivalent Privacy (WEP) keys and
The Compaq WL310 is an OEM Orinoco Residential Gateway access point.
Both the Compaq and Orinoco access points use a unique identification
found on the bottom of the access point for configuration through
their management client. This identification string is used as the
default SNMP read/write community string. The community strings appears
to be unchangable, unique, and not easily guessable. By sending a
specific packet to UDP port 192, the access point will return
information including the firmware version and the unique identification
value. The packet returned includes the value of system.sysName.0, which
in the case of the Compaq WL310 and Orinoco Residential Gateway,
the unique identification value. The identification value can then be
used as the SNMP community string to view and modify the configuration.
system.sysName.0 = "ORiNOCO RG-1100 0392a0"
Both vendors were notified of this issue on July 8th, 2002. According
to Orinoco, "The Residential Gateway line has been discontinued."
Employ packet filtering on inbound requests to deny access to ports
192/udp and 161/udp on the access point.
FoundScan has been updated to check for this vulnerability. For more
information on FoundScan, see the Foundstone website:
The information contained in this advisory is copyright (c) 2002
Foundstone, Inc. and is believed to be accurate at the time of
publishing, but no representation of any warranty is given,
express, or implied as to its accuracy or completeness. In no
event shall the author or Foundstone be liable for any direct,
indirect, incidental, special, exemplary or consequential
damages resulting from the use or misuse of this information.
This advisory may be redistributed, provided that no fee is
assigned and that the advisory is not modified in any way.