Linksys Router Owners - HEADS UP!

This was posted to bugtraq today. I know that many of you (including myself) use these routers at home. See below.


Denial of Service Vulnerability in

Linksys BEFSR41 - Router vuln was identified and tested on.

Linksys BEFSR41 v3

Linksys BEFSRU31

Linksys BEFSR11

Linksys BEFSX41

Linksys BEFSR81 v2/v3

Linksys BEFW11S4 v3

Linksys BEFW11S4 v4

Available from www.linksys.com

October 19, 2003 (Revised November 10, 2003)

Released Date: 3rd June 2004

NOTE: THIS ADVISORY WAS ORIGINALLY WITTEN FOR THE

Linksys BEFSR41 EtherFast Cable/DSL Router with 4-Port Switch



I. BACKGROUND



Linksys Group Inc.'s EtherFast Cable/DSL Router with 4-Port Switch

"is the perfect option to connect multiple PCs to a high-speed

Broadband Internet connection or to an Ethernet back-bone. Allowing

up to 253 users, the built-in NAT technology acts as a firewall

protecting your internal network." More information about it is

available at

http://www.linksys.com/products/prod...rid=20&grid=23



II. DESCRIPTION



It is possible for a remote/local attacker to crash the linksys router and

leave it in a state that it can't be accessed even after reboot due to an

invalid password. An attacker could set up a web page or send an html

email to someone inside the LAN to indirectly send commands to the router.

An attacker could specify a URL that results in denial of service. The DoS

Occurs when 2 long strings are sent to the sysPasswd and sysPasswdConfirm

Parameters on the Gozila.cgi script, about 150 characters to each parameter

Seems to work fine. If an attacker can get the admin of the router to view a link

Or goto a webpage that links to such a link as this.



http://192.168.1.1/Gozila.cgi?sysPas...AAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&sysPasswdConfirm=AAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAA&UPnP_Work=1&FactoryDefaults=0



The router will drop all internet connections making the internet inaccessible from the

LAN even if the router is powered off and back on. It also seems to change the

password in such a way that the admin can't log back into the router and the only way

to solve it is by pressing the factory reset button on the front of the router, Which will

then reset all previously stored settings and reset the password back to factory default

'admin'. The router would then need to be set back up again from scratch.





REVISED NOVEMBER 10, 2003





On November 10 2003 I found another overflow in linksys router which is a similar attack

method to the first vuln in this advisory. The DoS occurs in this attack when a long

string about 350 characters is passed to the 'DomainName' parameter of the Gozila.cgi

script. An example of this attack would be to get the admin of a router to visit a link

like this.



http://192.168.1.1/Gozila.cgi?hostNa...AAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&WANConnectionSel=0&ipAddr1=192&ipAddr2=168&

ipAddr3=1&ipAddr4=1&netMask=0&WANConnectionType=1



This would cause the router to crash and the Factory reset button on the front of the

Router would need to be pressed to restore it back to normal working order.







III. ANALYSIS



Exploitation may be particularly dangerous, especially if the router's remote

management capability is enabled. It may also be easily exploited by fooling

an admin of the router into clicking a link he/she thinks is valid. This is probably

vuln in older version of the firmware.



IV. DETECTION



This vulnerability affects the BEFSR41 EtherFast Cable/DSL router with the latest

firmware version 1.45.7 I also tested version 1.44.2z which is also vuln so probably

all other version below this are also vuln . It may also be possible that other version of

Linksys routers are vuln to this attack if they use the same type of management. I'm unable

to confirm any other models that are vuln to this attack. The Linksys BEFSRU31 and BEFSR11

use the same version of firmware as the BEFSR41 so they are probably vuln.



NOTE ADDED June 3rd 2004:

The Vendor confirmed this vuln in all version stated at the start of this advisory



V. RECOVERY



Pressing the reset button on the front of the router and setting it back up from scratch

should restore normal functionality to the router.



VI. WORKAROUND



Don't click untrusted links.



VII. VENDOR

19 Oct 2003: First vuln discovered.

10 Nov 2003: Second vuln discovered.

01 Dec 2003: Vendor contacted via [email protected]

01 Dec 2003: Response Recived from [email protected]

10 Dec 2003: Issue been turned over to project manager [email protected]

17 Dec 2003: I was sent a beta release of the new firmware witch fixed the vuln but

had a bug where the logging function wouldn't work.

22 DEc 2003: [email protected] now moved office now to contact [email protected]

29 Jan 2004: Was told patches would be up in the next week

29 Feb 2004: They said there was a problem with the code, still no patches

24 Mar 2004: Recived a email about patches saying.

BEFSR41 v3(Post on by 3/31)

BEFSX41 (posted)

BEFSR81 v2/v3(in progress)

BEFW11S4 v3(post by 3/31)

BEFW11S4 v4(posted)

02 Jun 2004: Advisory released to public still no patch for the Linksys BEFSR41

EtherFast Cable/DSL Router with 4-Port Switch

http://www.linksys.com/download/firmware.asp?fwid=3

The version this advisory was first written for it still remains vuln to date.





b0f (Alan McCaig)

[email protected]

www.b0f.net

I believe the pertinent phrase was if they can get admin access.... I'll test it tonight but I don't think you can get to the syspassword and sysconfirmpassword or anything else directly without first getting admin access.

Thus, right now I'm guessing, but changing the password to anything from the default should prevent this.

Additionally, most of these routers are left in their default factory configuration by the users so pressing the factory reset returns it to a fully functional state in seconds....

Yeah, and a big if might I add.

Quote:

---

The router will drop all internet connections making the internet inaccessible from the

LAN even if the router is powered off and back on.

---

That's quite scary for any regular PC user that has one of these and just has a few PC's linked up. What's even more scarier could be this part:

Quote:

---

It also seems to change the

password in such a way that the admin can't log back into the router and the only way

to solve it is by pressing the factory reset button on the front of the router

---

Now sure it could be solved a couple way's (one being mentioned is to his the reset button) but this could cause major problem's for routed computer's of home user's (as well as companies, networks, etc). Thanks for the head's up thehorse13, I should subscribe to bugtraq.

Quote:

---

Originally posted here by Spyder32
Thanks for the head's up thehorse13, I should subscribe to bugtraq.

---

...and here is a link to bugtraq if you want to subscribe to their mailing lists. Be warned you *will* receive a lot of mail...but it's good stuff! ;)

Quote:

---

Originally posted here by Spyder32
Yeah, and a big if might I add.



That's quite scary for any regular PC user that has one of these and just has a few PC's linked up. What's even more scarier could be this part:



Now sure it could be solved a couple way's (one being mentioned is to his the reset button) but this could cause major problem's for routed computer's of home user's (as well as companies, networks, etc). Thanks for the head's up thehorse13, I should subscribe to bugtraq.

---

Even worse are the users like myself who have the BEFSR81 and have a lot of customized settings, port forwarding, and the like. Most users, from what I've seen, use the DHCP functions and hence, resetting to a default state wouldn't be too bad. Now if you have a static IP, you have to re-enter all that information and if you assign static IPs like I do, that has to be redone as well.

Irritation all around, either way.

Ah, the good people at AO watching bugtraq ever so close. :)
I sold these two four port models awhile back. BEFSR41 & BEFSX41 time to make a couple of emails.
Maybe this will actually free up some of those Call_Of_Duty servers ;)


Good eye.

Well, I just tried this and I have to say something wierd happened. It did not shut down all the internet traffic, it did something worse. It dumped me right into the configuration page. No additional password necessary. Even worse, I'm not being asked to login. just constantly being dumped into the configuration screen.

If you'll excuse me, i'm going to reboot my router now...

BTW: i'm using a linksys WRT54G firmware version 2.02.7

Oh, here's the link i used... i'll remove it if any moderators want me to:
http://192.168.1.1/Gozila.cgi?sysPas...ctoryDefults=0

Quote:

---

Well, i just tried this and i have to say something wierd happened. It did not shut down all the internet traffic, it did something worse. It dumped me right into the configuration page! No additional password necessary. Even worse! i'm not being asked to login! just constantly being dumped into the configuration screen!

If you'll excuse me, i'm going to reboot my router now...

BTW: i'm using a linksys WRT54G firmware version 2.02.7

---

You may have found a new bug since your model is not listed among the ones tested. Submit the details to [email protected]. You should receive a beta build of firmware from them if they confirm the issue.

Yay! my first hack! oh well, still a skiddy since i have no idea what went wrong...

Thanks for the e-mail link TH13, i sent them all the information i could.

Also, upon hitting the reset switch everything went back to my normal settings... not the factory default... but that's because i only pressed the button instead of holding it for 5 seconds.

Annihilator_god > I just tried that on my router (WRT54G, Firmware v2.02.2), but it doesn't do anything (abnormal).

Here's the link I tried. To avoid the link being *****ed up, it's in quote-tags...

Quote:

---

http://192.168.1.1/Gozila.cgisysPass...toryDefaults=0

---

BTW: you have a little error in your link (unless that's what causes the error: you have Defults in stead of Defaults ;) ).

yes negative, i did spell defaults incorrectly in my "exploit" (if that's what you want to call it).
So that might be the problem... but i'm still just a newbie... i need to go download the source code from linksys again.

one more little thing negative, you might have overlooked this in your link... but there should be a ? between cgi and sysPasswd, like this: cgi?sysPasswd

and trying it with defaults spelled correctly has the same effect. So it's just some buffer overrun, right?

Quote:

---

port forwarding

---

*Raises hand* I feel your pain. I have that added on as well and it becomes irritable all around like you said.

Well, i just got a reply from a support guy at linksys.

Quote:

---

are you certain that you didn't have any web browser
windows open? If one web browser window was still open (not necessarily
one that you were using to access the router), the browser session would
still be authenticated. Can you please confirm this, and possibly
retry your test?

---

What happened is that i had logged in before running the link, and never closed every browser window. Upon reading this, i did close all of my browser windows and was prompted for the password before i could get in.

Hmmmmmmm,

I have seen a number of threads on this forum that suggest that a router/firewall is all that you need and that software firewalls are irrelevant crap.

Has anyone had a slight change of heart?

Please remember that the ancient members of my family do not even know what that "grey box" does..........although perhaps I should say "should do".............

Quotation:

"My name is Ozymandias, King of Kings,
Look upon my works ye mighty, and despair"

just a thought?

Whatever happened to intellectual honesty and ubris?

Quote:

---

I have seen a number of threads on this forum that suggest that a router/firewall is all that you need and that software firewalls are irrelevant crap.

---

Depend's how you look at it, really. It also depend's on the purpose and use of the machine, how much/often it's used, etc etc. That's a two-sided argument that we don't wanna get into right now :D

Quote:

---

Originally posted here by nihil
Hmmmmmmm,

I have seen a number of threads on this forum that suggest that a router/firewall is all that you need and that software firewalls are irrelevant crap.

Has anyone had a slight change of heart?

---

You should never rely on just one layer of security. This is exactly the reason I use multiple layers. Fortunately... I don't use linksys... but I use a Cisco router as my boarder router/firewall. (yes... I realize that cisco now owns linksys) Should anything "slip" past it... I've got more layers.

Maybe this will just be another "lesson learned"?

If one wanted... they could easily have two devices at the boarder. The linksys and then an old cheap box (you know you all have them stuffed in your basement/closets) as the second method of protection. IPCop or Smoothwall woud be perfect for a job like this. Easy to configure and a hell of a lot more options than the linksys should anything slip past it.

In this case... it won't matter too much...because its a DoS and the router will still have to be reset, but it *could* have been much worse?

Just curious... as I haven't used one of these Linksys routers in a long time.. but the newer firmware does give you an option to backup your configurations... right? Maybe that was D-Link?

Anyway... what are you doing here? You should be patching your "router"!
(If your model has a patch...) :D

Quote:

---

I believe the pertinent phrase was if they can get admin access.

---

silly me, I thought the pertinent phrase was

Quote:

---

"is the perfect option to connect multiple PCs to a high-speed Broadband Internet connection or to an Ethernet back-bone.

---

I thought there were only three perfect things in this world, and two of them are Senior members of AO. :jester:

Thanks for the info thehorse13, I would have missed it. I'm sure I'll be getting alot of questions because of this, like "... my router crapped out, what do you recomend I replace it with?"

phishphreek80 hit the nail on the head here. Layered security. How many times does this have to be mentioned? Everytime I think the message is moot and EVERYONE has resolved it as second nature, I read another article on how someone has come up with the ultimate security solution which purportedly solves all.

Security is a team effort: from the chip manufactures to the programs of the bios, OS, drivers, and runtime programs, to the CIOs, network anmins, techs, and finally users. The same is as true for the hardware as software.

"The chain is only as strong as the weakest link" ( have no idea who said that, but damn if it ain't true!)

Okay I just tested the exploit against the previous BEFSR41 (not the ver 3) and I suffered nothing but a pop up asking for my username and password. Victory tastes so sweet. Anyways, I guess if you change your username and password you are safe. Either that or the old one is just better. Either way I am going to sleep a happy man!

Tested on BEFSR41 v1, Firmware 1.45.7. The exploit works as described. :mad:

Linksys BEFSR41
Firmware: 1.43, Sep 04 2002

Clicked the link in annihilator's post: Password required.

Fixed the link, ("Defaults"): Password required.

Noticed all the <br> tags.... removed them: Password required.

I can't seem to make it do anything but bring up the password box..... Maybe I'm dumb or something.... :eek:

Off topic slightly, not a linksys user here:

These routers don't have the capability to backup firmware?

Nope (at least the BEFSR41), but you *can* reload older revs via their TFTP utility. Not much help but I can see why they wouldn't care much about this feature based on the target audience.

--TH13

They don't have the ability to backup the user settings. Once you do a "cold" reboot (most Linksys routers can be reset by pushing the reset-button for a second, and this won't delete the user settings; the cold reboot though - done by pushing the reset-button for five seconds - does), you'll have to setup everything again...

The danger will really come when something like this reflashes the firmware to garbage so that the firmware can't be updated again.... Thus you have a pretty doorstop....

Didn't see this listed in the advisory... or anywhere in the discussion...
Maybe I missed it? Its probably another advisory all together...

Apparently these routers are also vulnerable to remote sniffing.

This is because of the way that the BOOTP returns its requests... it includes part of the memory in the return...

The article can explain it better than I:

http://www.theinquirer.net/?article=16298

There are links in the article to more specific info on the exploit.

Note: There is updated firmware for the Linksys BEFSX41 (Firmware Version : 1.50.18 dated 4/30/2004). (I think that I have this router, but I am not at home)

hmpf not to happy about this

BEFSR41 v3(Post on by 3/31)

I have v2 of this router and it appears as if Linksys aren't going to release anymore firmware for it. This can be expected I suppose because its an older product, but at the very least I would expect that they would fix major security issues like this...

Also it does tick me off that they just release a new version of the same product, without actually changing the name of the product, it makes it a lil harder to find firmware/support for your EXACT version.....

Anyone know if the v3 firmware will work on the older versions of the same router?

Edit = I just sent them an email asking about the status of this. I will report back my reply

Linksys are not having a very good time

The WRT54G wireless router has got a problem that aloows users on the WAN side to reconfigure it.


http://www.securiteam.com/securitynews/5LP060KD5K.html

Heres the reply I got, I must say that they are VERY quick in replying


Hello,

I have been updated that most of the updates hopefully will be posted end of today, US time so please do keep checking the webpage.

Sorry the version two can't use V3 firmware.

Quote:

---

Originally posted here by cheesegoduk
hmpf not to happy about this

BEFSR41 v3(Post on by 3/31)

I have v2 of this router and it appears as if Linksys aren't going to release anymore firmware for it. This can be expected I suppose because its an older product, but at the very least I would expect that they would fix major security issues like this...

Also it does tick me off that they just release a new version of the same product, without actually changing the name of the product, it makes it a lil harder to find firmware/support for your EXACT version.....

Anyone know if the v3 firmware will work on the older versions of the same router?

Edit = I just sent them an email asking about the status of this. I will report back my reply

---

I would be interested to know. If I dont have the router I mentioned above, I have the same one as you. I cant remember which one I bought.

Edit: Too fast for me. ;)

Still doesn't appear to be any updates from them :s has of 6 june 3am UK time

Looks like Linksys have released the updates at last to fix this issue

Firmware for BEFSR41 ver. 1 & ver. 2.x Here

However they don't appear to have released a fix for version 3 of this router yet.