Zyxel / Netgear and probably other routers leaking information.

[Jens Kalvik <jens.kalvik@xxxxxxxxx>]

Hi!

I have discovered a serious problem with the following routers:
Zyxel P310, P314, P324 and Netgaear RT311, RT314 all with the latest firmware 
available as of 2005-01-20. I think that the problem is present in all routers 
using Zynos, but I am not sure.

Let say you have a Computer with IP: 192.168.0.50 connected to the WAN side of 
a router that has 192.168.1.1 on WAN and 192.168.0.1 on the LAN side. If I send 
a ping to 192.168.0.1 (LAN on router) then I get request timed out, but if I 
look in my arp cache I will see this:

192.168.0.1 xx-xx-xx-xx-xx-xx

where xx-xx-xx-xx-xx-xx is the mac address of the WAN side. So the result must 
be that if I send a packet with the same destination IP as the routers LAN IP, 
I will get an ARP reply from the WAN side. This can be used to get information 
about which IP adresses are used on the LAN side when you are sitting on the 
WAN side. It is also possible to pollute the ARP cache on your ISPs equipment 
by changing the IP adress on your lan side. 

Zyxels response to this is that we have choosen the wrong equipment (I agree 
:-) they told me to use VLAN as a workaround.

/Jens