LinkSys WRT54G administration page availble to WAN

[Alan W. Rateliff, II]

Manufacturer: LinkSys (a division of Cisco)
Product: Wireless-G Broadband Router
Model: WRT54G
Product Page:
http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=601
Firmware tested: v2.02.7

In a recent client installation I discovered that even if the remote
administration function is turned off, the WRT54G provides the
administration web page to ports 80 and 443 on the WAN. The implications
are obvious: out of the box the unit gives full access to its administration
from the WAN using the default or, if the user even bothered to change it,
an easily guessed password.

I reported this to LinkSys (along with a number of other non-security
related issues) on April 28. I received no reponse addressing this, and no
updated firmware has yet appeared on their firmware page
http://www.linksys.com/download/firmware.asp?fwid=201

To work around this, you can use the port forwarding (irritatingly renamed
to Games and whatever) to send ports 80 and 443 to non-existant hosts. Note
that forwarding the ports to any hosts -- inluding listening ones if you are
actually running servers -- will override the default behavior.

On a personal note, there are a number of reasons for which I am thoroughly
disappointed with LinkSys since the acquisition by Cisco. For the sake of
what was once a rock-solid product and great brand name, I hope things
change soon.

--
Alan W. Rateliff, II : RATELIFF.NET
Independent Technology Consultant : alan2@rateliff.net
(Office) 850/350-0260 : (Mobile) 850/559-0100
-------------------------------------------------------------
[System Administration][IT Consulting][Computer Sales/Repair]

[Steffen Mueller]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Am Montag, 31. Mai 2004 18:51 schrieb Alan W. Rateliff, II:

Hello Alan,

did you check the alternative firmwares available for the Linksys ?

Great enhancements are available from SVEASOFT.=20

http://www.sveasoft.com/modules/phpBB2/index.php

Best regards,

Steffen
=2D ---
Steffen M=FCller - Senior Consultant Networks & Security
Milcheshohl 35b
D-61462 K=F6nigstein i. Ts.
Tel: +49-6174-2939480 * Fax: +49-6174-2939481 * Mobil: +49-179-1078880
Home: http://www.vision-it.de/mueller
GPG Key fingerprint =3D EC28 8B86 DA43 200B 50B1 EEF0 3AB9 369A FB05 E6D5



=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAvJYCOrk2mvsF5tURApTrAKCG/E0/X5f6W2rGct4aXePNBafXvACeIDhb
7hRcZI55r7jcaa+Dj2geUK0=3D
=3DoSzJ
=2D----END PGP SIGNATURE-----

[Alan W. Rateliff, II]

> -----Original Message-----
> From: Matthew Gillespie [mailto:mgillespie@socket.net]
> Sent: Tuesday, June 01, 2004 9:29 AM
> To: Alan W. Rateliff, II
> Cc: bugtraq@securityfocus.com
> Subject: Re: LinkSys WRT54G administration page availble to WAN

> Initially I spoke with an outsourced group of individuals
> that recommended
> I forward port 80 inquiries to a null ip. This DOES work,
> however is very
> sloppy.

Agreed. I would prefer the problem be fixed, but this does work when all
else fails. :/

> After repeated problems with remote admin STAYING on (keep
> in mind, it was
> disabled, along with various other settings) I again
> contacted linksys where
> a friendly individual informed me, "If you continue to have
> the problem you
> could just buy a new router".

This is pretty much what they told me, in not so many words. I was
astonished and disappointed.

> All of this is documented in emails I have sent to Linksys.
> I have spoken
> to Jason Hardy throughout April (Linksys Product Support
> Case#: 2423404 and
> RE: Linksys Product Support Case#: 242340) however the issue
> has yet to be
> resolved.

I haven't been able to contact Jason for a couple of years. The last
contact I had with him was an issue with the WAP11v1 ignoring DHCP
assignments from the Ascend Pipeline 75. I'm glad to see he survived the
buyout. I considered him a valuable contact; the kind of guy who knows that
needs to be done, but seems to be caught it a pool of red tape.

--
Alan W. Rateliff, II : RATELIFF.NET
Independent Technology Consultant : alan2@rateliff.net
(Office) 850/350-0260 : (Mobile) 850/559-0100
-------------------------------------------------------------
[System Administration][IT Consulting][Computer Sales/Repair]

[Alan W. Rateliff, II]

> -----Original Message-----
> From: Matthew Caron [mailto:matt@mattcaron.net]
> Sent: Monday, May 31, 2004 5:19 PM
> To: Alan W. Rateliff, II
> Cc: bugtraq@securityfocus.com
> Subject: Re: LinkSys WRT54G administration page availble to WAN
>
> Isn't that the Linksys product that runs Linux and all these
> folks have
> been making custom firmware for? If so, can't one of those folks fix
> this bug if Linksys it taking too long?

Perhaps, but the points still remain that LinkSys is distributing a
vulnerable product through all channels, retail stores are blowing this item
out with rebates, and Joe Average User isn't going to upgrade to a custom
Linux-based firmware because chances are he or she is not aware of it.

Also, I have received a shit-storm of auto-replies from my original post.
Hey, people, DON'T SUBSCRIBE TO A LIST USING AN ADDRESS WITH
AUTO-RESPONDERS!!

After wading through 30-or-so of these auto-responses, I found three valid
emails. The general answer is that I had an open dialogue with LinkSys
support (case #AEV-14523-534, which refers to #KNU-66355-624,) the problem
was originally noted to them on 04/28/04, and because of my open dialogue
with LinkSys support I did not send an email to any other address or
department at LinkSys.

In regards to the last part, I do now feel somewhat remiss for not having
done so, however at the same time a proven security issue should be properly
communicated from support to the appropriate department. That seems to not
be the case, and assumption is the evil of all root.

--
Alan W. Rateliff, II : RATELIFF.NET
Independent Technology Consultant : alan2@rateliff.net
(Office) 850/350-0260 : (Mobile) 850/559-0100
-------------------------------------------------------------
[System Administration][IT Consulting][Computer Sales/Repair]

[Matthew Gillespie]

Alan,

I have personally contacted Linksys in regards to this problem (it appears
that a glitch in WRT54G and in BEFSR41v3 cause this problem). Both pieces of
equipment were running current firmware (I don't have my notes with me at
the moment, but the firmware was current). And in both instances remote
admin was available via port 80 on the WAN side.

Initially I spoke with an outsourced group of individuals that recommended
I forward port 80 inquiries to a null ip. This DOES work, however is very
sloppy. Later I asked for the source code to BEFSR41v3, to modify the bug
myself but was denied as it is propietary.

After repeated problems with remote admin STAYING on (keep in mind, it was
disabled, along with various other settings) I again contacted linksys where
a friendly individual informed me, "If you continue to have the problem you
could just buy a new router".

All of this is documented in emails I have sent to Linksys. I have spoken
to Jason Hardy throughout April (Linksys Product Support Case#: 2423404 and
RE: Linksys Product Support Case#: 242340) however the issue has yet to be
resolved.

So I'd suggest forwarding port 80 inquries to a null ip in the meantime,
good work Linksys.


----- Original Message -----
From: "Alan W. Rateliff, II" <lists@rateliff.net>
To: <bugtraq@securityfocus.com>
Sent: Monday, May 31, 2004 11:51 AM
Subject: LinkSys WRT54G administration page availble to WAN


> Manufacturer: LinkSys (a division of Cisco)
> Product: Wireless-G Broadband Router
> Model: WRT54G
> Product Page:
> http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=601
> Firmware tested: v2.02.7
>
> In a recent client installation I discovered that even if the remote
> administration function is turned off, the WRT54G provides the
> administration web page to ports 80 and 443 on the WAN. The implications
> are obvious: out of the box the unit gives full access to its
administration
> from the WAN using the default or, if the user even bothered to change it,
> an easily guessed password.
>
> I reported this to LinkSys (along with a number of other non-security
> related issues) on April 28. I received no reponse addressing this, and
no
> updated firmware has yet appeared on their firmware page
> http://www.linksys.com/download/firmware.asp?fwid=201
>
> To work around this, you can use the port forwarding (irritatingly renamed
> to Games and whatever) to send ports 80 and 443 to non-existant hosts.
Note
> that forwarding the ports to any hosts -- inluding listening ones if you
are
> actually running servers -- will override the default behavior.
>
> On a personal note, there are a number of reasons for which I am
thoroughly
> disappointed with LinkSys since the acquisition by Cisco. For the sake of
> what was once a rock-solid product and great brand name, I hope things
> change soon.
>
> --
> Alan W. Rateliff, II : RATELIFF.NET
> Independent Technology Consultant : alan2@rateliff.net
> (Office) 850/350-0260 : (Mobile) 850/559-0100
> -------------------------------------------------------------
> [System Administration][IT Consulting][Computer Sales/Repair]
>
>
>
>
>

[Matthew Caron]

Isn't that the Linksys product that runs Linux and all these folks have
been making custom firmware for? If so, can't one of those folks fix
this bug if Linksys it taking too long?

Alan W. Rateliff, II wrote:
> Manufacturer: LinkSys (a division of Cisco)
> Product: Wireless-G Broadband Router
> Model: WRT54G
> Product Page:
> http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=601
> Firmware tested: v2.02.7
>
> In a recent client installation I discovered that even if the remote
> administration function is turned off, the WRT54G provides the
> administration web page to ports 80 and 443 on the WAN. The implications
> are obvious: out of the box the unit gives full access to its administration
> from the WAN using the default or, if the user even bothered to change it,
> an easily guessed password.
>
> I reported this to LinkSys (along with a number of other non-security
> related issues) on April 28. I received no reponse addressing this, and no
> updated firmware has yet appeared on their firmware page
> http://www.linksys.com/download/firmware.asp?fwid=201
>
> To work around this, you can use the port forwarding (irritatingly renamed
> to Games and whatever) to send ports 80 and 443 to non-existant hosts. Note
> that forwarding the ports to any hosts -- inluding listening ones if you are
> actually running servers -- will override the default behavior.
>
> On a personal note, there are a number of reasons for which I am thoroughly
> disappointed with LinkSys since the acquisition by Cisco. For the sake of
> what was once a rock-solid product and great brand name, I hope things
> change soon.
>

--
Security through obscurity falls apart when someone steals your
source code.
--------------------------------------------------------------------
PGP Key: http://www.mattcaron.net/pgp_key.txt
~~ Matt Caron ~~

[Valdis.Kletnieks@vt.edu]

--==_Exmh_492261736P
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

On Tue, 01 Jun 2004 16:43:05 +0200, Steffen Mueller <steffen.mueller@visi=
on-it.de> said:

> did you check the alternative firmwares available for the Linksys ?
> =

> Great enhancements are available from SVEASOFT. =

> =

> http://www.sveasoft.com/modules/phpBB2/index.php

I haven't looked, but all the same, it's probably insanely great.

The problem is that 95% of the people that buy a Linksys couldn't figure =
out
how to jump through all the hoops to install it.

Sure, Alan can install it. And probably a few dozen others on the list w=
ill be
motivated to do the firmware upgrade. However, if Linksys sold 5 million=
of
these critters, that leaves 4,999,950 or so with lame defaults....

Consider another example - it's *quite* possible to nail down a Windows b=
ox to
drastically tighten the security on it. Why do we still have problems? B=
ecause
it isn't that way "out of the box", and users can't/won't do it after unb=
oxing
it....


--==_Exmh_492261736P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFAvNRQcC3lWbTT17ARAmJDAKCA/ke23BBdHFE25FhixTC52e74+gCgs6mo
+vYnTA604tNw2GPV+WWY0jg=
=ZcZf
-----END PGP SIGNATURE-----

--==_Exmh_492261736P--

[Jason Munro]

On 11:51:41 am 05/31/04 "Alan W. Rateliff, II" <lists@rateliff.net> wrote:
> Manufacturer: LinkSys (a division of Cisco)
> Product: Wireless-G Broadband Router
> Model: WRT54G
> Product Page:
> http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=601
> Firmware tested: v2.02.7
>
> In a recent client installation I discovered that even if the remote
> administration function is turned off, the WRT54G provides the
> administration web page to ports 80 and 443 on the WAN. The
> implications are obvious: out of the box the unit gives full access
> to its administration from the WAN using the default or, if the user
> even bothered to change it, an easily guessed password.

Testing this issue with a recently purchased WRT54G here showed that while
I can access the web interface on the WAN IP from the LAN behind the
linksys, I can not access it from another location on the WAN side.

\__ Jason Munro
\__ jason@stdbev.com
\__ http://hastymail.sourceforge.net/

[Humes, David G.]

I have a WRT54G at home. After seeing all the discussion here about the
remote administration vulnerability I tried to access the web interface
today on ports 80 and 443 from outside of my home network and was not able
to get to the web interface either.

But, having said that, I'm still fairly disappointed with this product.
Linksys used to incorporate SNMP support that made it possible to use
Linklogger, a very inexpensive and capable firewall logger. But, it appears
that SNMP and syslog support are gone. I contacted tech support about this
and they agreed that the WRT54G has no support for external event logging.
Too bad.

--Dave

-----Original Message-----
From: Jason Munro [mailto:jason@stdbev.com]
Sent: Wednesday, June 02, 2004 2:30 PM
To: bugtraq@securityfocus.com
Subject: Re: LinkSys WRT54G administration page availble to WAN


On 11:51:41 am 05/31/04 "Alan W. Rateliff, II" <lists@rateliff.net> wrote:
> Manufacturer: LinkSys (a division of Cisco)
> Product: Wireless-G Broadband Router
> Model: WRT54G
> Product Page:
> http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=601
> Firmware tested: v2.02.7
>
> In a recent client installation I discovered that even if the remote
> administration function is turned off, the WRT54G provides the
> administration web page to ports 80 and 443 on the WAN. The
> implications are obvious: out of the box the unit gives full access
> to its administration from the WAN using the default or, if the user
> even bothered to change it, an easily guessed password.

Testing this issue with a recently purchased WRT54G here showed that while
I can access the web interface on the WAN IP from the LAN behind the
linksys, I can not access it from another location on the WAN side.


\__ Jason Munro
\__ jason@stdbev.com
\__ http://hastymail.sourceforge.net/

[Peter Becker]

> I have a WRT54G at home. After seeing all the discussion here about the
> remote administration vulnerability I tried to access the web interface
> today on ports 80 and 443 from outside of my home network and was not able
> to get to the web interface either.
>
> But, having said that, I'm still fairly disappointed with this product.
> Linksys used to incorporate SNMP support that made it possible to use
> Linklogger, a very inexpensive and capable firewall logger. But, it
appears
> that SNMP and syslog support are gone. I contacted tech support about
this
> and they agreed that the WRT54G has no support for external event logging.
> Too bad.

There are several other firmwares for this product.
I use OpenWRT this is realy great.
I don't know, if the other firmware makes it possible to external event log,
but you could make nfs-mounts so you could write the eventlog on a
network-share.

To the issue:
I tested the original firmware before flashing.
And I also wasn't able to access the webinterface from the wan-port.
I've got hardware revision 2.


Peter

[Paul Wouters]

On Thu, 3 Jun 2004, Peter Becker wrote:

> I tested the original firmware before flashing.
> And I also wasn't able to access the webinterface from the wan-port.
> I've got hardware revision 2.

I thought I was mad. I wasted quite some time accidently putting the
cable in the wan port instead of the lan ports.....

Paul

[Jerry Zwanenburg]

In-Reply-To: <019201c4494b$9a3c1460$476ffc50@tera>

Peter,

I agree on that.

For the external loggin. Look at www.wallwatcher.com.
Its a great free tool written for linksys.

Cheers,
Jerry


>Received: (qmail 11131 invoked from network); 3 Jun 2004 19:57:09 -0000
>Received: from outgoing.securityfocus.com (HELO outgoing3.securityfocus.com) (205.206.231.27)
> by mail.securityfocus.com with SMTP; 3 Jun 2004 19:57:09 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing3.securityfocus.com (Postfix) with QMQP
> id D892B236FD2; Thu, 3 Jun 2004 18:43:34 -0600 (MDT)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 1667 invoked from network); 3 Jun 2004 03:04:23 -0000
>Message-ID: <019201c4494b$9a3c1460$476ffc50@tera>
>From: "Peter Becker" <peter.becker@oberkassel.de>
>To: <bugtraq@securityfocus.com>
>References: <C0BEC2592902BF45B8777C49B1F2A08C5485FA@aples2.dom1 .jhuapl.edu>
>Subject: Re: LinkSys WRT54G administration page availble to WAN
>Date: Thu, 3 Jun 2004 11:17:27 +0200
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="iso-8859-1"
>Content-Transfer-Encoding: 7bit
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Mailer: Microsoft Outlook Express 6.00.2800.1409
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
>
>> I have a WRT54G at home. After seeing all the discussion here about the
>> remote administration vulnerability I tried to access the web interface
>> today on ports 80 and 443 from outside of my home network and was not able
>> to get to the web interface either.
>>
>> But, having said that, I'm still fairly disappointed with this product.
>> Linksys used to incorporate SNMP support that made it possible to use
>> Linklogger, a very inexpensive and capable firewall logger. But, it
>appears
>> that SNMP and syslog support are gone. I contacted tech support about
>this
>> and they agreed that the WRT54G has no support for external event logging.
>> Too bad.
>
>There are several other firmwares for this product.
>I use OpenWRT this is realy great.
>I don't know, if the other firmware makes it possible to external event log,
>but you could make nfs-mounts so you could write the eventlog on a
>network-share.
>
>To the issue:
>I tested the original firmware before flashing.
>And I also wasn't able to access the webinterface from the wan-port.
>I've got hardware revision 2.
>
>
>Peter
>
>