Linksys WRT54G Router Remote Administration apply.cgi Buffer Overflow
Vulnerability

iDEFENSE Security Advisory 09.13.05
www.idefense.com/application/poi/display?id=305&type=vulnerabilities
September 13, 2005

I. BACKGROUND

The Linksys WRT54G is a combination wireless access point, switch and
router. More information is available at the following URL:

 http://www.linksys.com/products/product.asp?prid=508

II. DESCRIPTION

Remote exploitation of a buffer overflow vulnerability in multiple 
versions of the firmware for Cisco Systems Inc.'s Linksys WRT54G
wireless router may allow unauthenticated execution of arbitrary
commands as the root user.

The vulnerability specifically exists in the 'apply.cgi' handler of the 
httpd running on the internal interfaces, including the by default the 
wireless interface. This handler is used by the many of the
configuration pages to perform the configuration management of the
router.

If an unauthenticated remote attacker sends a POST request to the 
apply.cgi page on the router with a content length longer than 10000 
bytes, an exploitable buffer overflow may occur.

III. ANALYSIS

Successful exploitation of this vulnerability would allow an 
unauthenticated user to execute arbitrary commands on the affected
router with root privileges. This could allow any operation to be
performed on the router, including changing passwords and firewall
configuration, installation of new firmware with other features, or
denial of service. Exploitation of this vulnerability requires that an
attacker can connect to the web management port of the router. The
httpd is running by default but is only accessible via the LAN ports or
the WLAN (wireless LAN). An attacker who can associate via the wireless
interface to the network running a vulnerable httpd could send an
exploit from a wireless device, and so not require direct physical
access to an affected network. Additionally, if the httpd is configured
to listen on the WAN (internet) interface, this vulnerability would be
exploitable remotely over the internet.

On some versions of the WRT54G firmware the buffer used to store the
POST input, 'post_buf', is before a structure in memory containing
pointers to the 'mime_handlers' structure, which contains function
pointers for handling the various types of input. By overwriting this
structure so some function pointers point into post_buf, it is possible
to execute arbitrary commands. Overwriting these values with nulls will
prevent access to the httpd on the system until the router is
restarted. Overwriting these values with 'garbage' values will cause
the httpd to crash but it will be restarted by a system monitoring
process within 2 minutes, allowing multiple exploitation attempts.

Although authentication checks are performed on access to this page, the

code which reads in the buffer is executed even if authentication fails,

so as to clear the input buffer from the client before returning an
error message. This may allow an unauthenticated user to exploit the 
vulnerability.

IV. DETECTION

iDEFENSE has confirmed the existence of this vulnerability in version 
3.01.03 of the firmware of the Linksys WRT54G, and has identified the 
same code is present in version 3.03.6. All versions prior to 4.20.7 may

be affected.

As this firmware is Open Source, and based on a reference implementation

supplied by the original hardware maker, there may be other affected 3rd

party firmware which use the same or similar code, and are thus also 
affected.

V. WORKAROUND

In order to mitigate exposure of the internal network to outside 
attackers, ensure encryption is enabled on the wireless interface. The 
exact settings to use are dependent on your wireless deployment
policies.

VI. VENDOR RESPONSE

This vulnerability is addressed in firmware version 4.20.7 available for
download at:

http://www.linksys.com/servlet/Satellite?childpagename=US%2FLayout
 
&packedargs=c%3DL_Download_C2%26cid%3D1115417109974%26sku%3D112491680264
5
 &pagename=Linksys%2FCommon%2FVisitorWrapper

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-2799 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

06/07/2005 Initial vendor notification
06/07/2005 Initial vendor response
09/13/2005 Coordinated public disclosure

IX. CREDIT

This vulnerability was discovered by Greg MacManus of iDEFENSE Labs.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.