Bugtraqmailing list archives

By Date

By Thread

iDEFENSE Security Advisory 09.13.05: Linksys WRT54G 'upgrade.cgi' Firmware Upload Design Error Vulnerability

Linksys WRT54G 'upgrade.cgi' Firmware Upload Design Error VulnerabilityiDEFENSE Security Advisory 09.13.05www.idefense.com/application/poi/display?id=307&type=vulnerabilitiesSeptember 13, 2005I. BACKGROUNDThe Linksys WRT54G is a combination wireless access point, switch androuter. More information is available at the following URL:http://www.linksys.com/products/product.asp?prid=508II. DESCRIPTIONRemote exploitation of a design error in the upgrade.cgi component of Cisco Systems Inc.'s Linksys WRT54G wireless router may allow unauthenticated modification of the router firmware. The vulnerability specifically exists in the "POST" method of the upgrade.cgi handler. The httpd running on the internal interfaces, including by default the wireless interface, does not check if authentication has failed until after data supplied by an external user has been processed. The upgrade.cgi handler allows a user to upload new firmware, which contains the operating system and applications, into thenon-volatile memory of the router.If the user is authenticated, the router will then restart, and the new firmware will be loaded. If the user is not authenticated, they will receive an error page when they attempt to upload a new firmware withoutsupplying authentication and the router will not reboot. The firmware will be saved, but will not take effect until the next time the router restarts.III. ANALYSISSuccessful exploitation of this vulnerability would allow anunauthenticated user the ability to completely compromise the affectedrouter, by installation of an arbitrary firmware. As the source code andtools for compiling the firmware are available from the vendor, anattacker could simply rebuild the firmware and add the extrafunctionality. Exploitation of this vulnerability would require that anattacker connect to the web management port of the router. The httpd isrunning by default but is only accessible via the LAN ports or the WLAN(wireless LAN). For the uploaded firmware to be enabled, the routermust be restarted.IV. DETECTIONiDEFENSE has confirmed the existence of this vulnerability in version 3.01.03 of the firmware of the Linksys WRT54G wireless router, and has identified the same code is present in versions 3.03.6 and 4.00.7. All versions prior to 4.20.7 may be affected.V. WORKAROUNDTo mitigate exposure of the internal network to outside attackers, ensure encryption is enabled on the wireless interface. The exact settings to use are dependent on your wireless deployment policies.        VI. VENDOR RESPONSEThis vulnerability is addressed in firmware version 4.20.7 available fordownload at:http://www.linksys.com/servlet/Satellite?childpagename=US%2FLayout &packedargs=c%3DL_Download_C2%26cid%3D1115417109974%26sku%3D1124916802645 &pagename=Linksys%2FCommon%2FVisitorWrapperVII. CVE INFORMATIONA Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has notbeen assigned yet.VIII. DISCLOSURE TIMELINE07/05/2005 Initial vendor notification07/25/2005 Initial vendor response09/13/2005 Coordinated public disclosureIX. CREDITThis vulnerability was discovered by Greg MacManus of iDEFENSE Labs.Get paid for vulnerability researchhttp://www.idefense.com/poi/teams/vcp.jspFree tools, research and upcoming eventshttp://labs.idefense.comX. LEGAL NOTICESCopyright (c) 2005 iDEFENSE, Inc.Permission is granted for the redistribution of this alertelectronically. It may not be edited in any way without the expresswritten consent of iDEFENSE. If you wish to reprint the whole or anypart of this alert in any other medium other than electronically, pleaseemail customerservice () idefense com for permission.Disclaimer: The information in the advisory is believed to be accurateat the time of publishing based on currently available information. Useof the information constitutes acceptance for use in an AS IS condition.There are no warranties with regard to this information. Neither theauthor nor the publisher accepts any liability for any direct, indirect,or consequential loss or damage arising from use of, or reliance on,this information.

By Date

By Thread

Current thread:

• iDEFENSE Security Advisory 09.13.05: Linksys WRT54G 'upgrade.cgi' Firmware Upload Design Error VulnerabilityiDEFENSE Labs (Sep 13)