The Linksys WRT54G "security problem" doesn't exist

[David Pipe]

> In a recent client installation I discovered that even if the remote
> administration function is turned off, the WRT54G provides the
> administration web page to ports 80 and 443 on the WAN.

I think the "Independent consultant" quoted in InternetWeek is wrong. I
think he either has a defective router or his cables are plugged into the
wrong end of the thing.

This clearly works properly on my Linksys WRT54G. No access of
administrative site on the WAN side when it's turned off. Period.

Comments and questions:

1) No one has been able to confirm this problem. Isn't that right?

2) The "Independent consultant" did not say he tried with more than one
router, and it appears that he did not ask anyone else if they would
check this out on their routers before he decided the sky was falling.

3) Thousands and thousands of these things have been sold for months an no
one has reported this error before.

4) Certainly such an aggregious error would have been discovered before
now, as hackers routinely bang away at IP addresses and find this stuff.

5) Does he really think that Cisco/Linksys would not test such a basic
basic basic aspect of this router's security?

6) How did this get on to InternetWeek? Does anyone actually check these
things out before publishing them?

Please, prove me wrong on all points. Can anyone reproduce this?

Dave

[insecure]

David Pipe wrote:

>>In a recent client installation I discovered that even if the remote
>>administration function is turned off, the WRT54G provides the
>>administration web page to ports 80 and 443 on the WAN.
>>
>>
>
>I think the "Independent consultant" quoted in InternetWeek is wrong. I
>think he either has a defective router or his cables are plugged into the
>wrong end of the thing.
>
>This clearly works properly on my Linksys WRT54G. No access of
>administrative site on the WAN side when it's turned off. Period.
>
>Comments and questions:
>
>1) No one has been able to confirm this problem. Isn't that right?
>
>2) The "Independent consultant" did not say he tried with more than one
>router, and it appears that he did not ask anyone else if they would
>check this out on their routers before he decided the sky was falling.
>
>3) Thousands and thousands of these things have been sold for months an no
>one has reported this error before.
>
>4) Certainly such an aggregious error would have been discovered before
>now, as hackers routinely bang away at IP addresses and find this stuff.
>
>5) Does he really think that Cisco/Linksys would not test such a basic
>basic basic aspect of this router's security?
>
>6) How did this get on to InternetWeek? Does anyone actually check these
>things out before publishing them?
>
>Please, prove me wrong on all points. Can anyone reproduce this?
>
>Dave
>
>
>
OK, you're wrong on all points. Here's a quote from the vendor:

Linksys, A division of Cisco Systems, Inc.

Product: WRT54G

Classification: Firmware Release History

Firmware Date: 6/2/2004

Release Date: BETA RELEASE

Last Firmware Version: 2.02.8_BETA
__________________________________________________ ________________________
Firmware 2.02.8_BETA
- Resolved security issue where remote management is enabled on port 80
and 443 when firewall is disabled

[David Gillett]

> > 5) Does he really think that Cisco/Linksys would not test
> > such a basic basic basic aspect of this router's security?
>
> Yes. How many times have "basic basic basic" aspects of security gone
> untested, or flaws gone unnoticed? How long was port 1900 open on my
> SMC Barricade? How many "basic basic basic" aspects of security
> has Microsoft, various Linux distros, Sun, and even MacOS X violated?

Cisco's purchase of LinkSys is still relatively recent. I've found,
in the past, fundamental code flaws in products being marketed by Cisco
up to a year after their acquisition of the originating company....\
Just because they've put their name on the outside of the box doesn't
mean they've fully QA'd the innards.

David Gillett

In-Reply-To: <20040605005326.24937.qmail@www.securityfocus.com>

>
>Firmware Version: v1.42.2
>Current Time: Fri, 11 Jan 2002 10:34:54
>MAC Address: 00:0C:41:A9:F8:76
>Router Name: WRT54G
>

Upgraded to WRT54G 2.02.8, it solves the problem. I updated the firmware remotely through the "security problem". After the firmware completed, I was disconnected. I nmap'd the router and everything looks great. Linksys' site is poor on navigation. I thou
ght firmware would be under Support, or technical support, but isn't. I had to go to the Products section, picked the WRT54G out and firmware was on the right hand side.

http://www.linksys.com/download/firmware.asp?fwid=201
ftp://ftp.linksys.com/pub/network/wrt54g_2.02.8_US_code_beta.zip

Cheers,

CC.