Linksys WRT54G Router Remote Administration apply.cgi Buffer Overflow
Vulnerability
iDEFENSE Security Advisory 09.13.05
www.idefense.com/application/poi/display?id=305&type=vulnerabilities
September 13, 2005
I. BACKGROUND
The Linksys WRT54G is a combination wireless access point, switch and
router. More information is available at the following URL:
http://www.linksys.com/products/product.asp?prid=508
II. DESCRIPTION
Remote exploitation of a buffer overflow vulnerability in multiple
versions of the firmware for Cisco Systems Inc.'s Linksys WRT54G
wireless router may allow unauthenticated execution of arbitrary
commands as the root user.
The vulnerability specifically exists in the 'apply.cgi' handler of the
httpd running on the internal interfaces, including the by default the
wireless interface. This handler is used by the many of the
configuration pages to perform the configuration management of the
router.
If an unauthenticated remote attacker sends a POST request to the
apply.cgi page on the router with a content length longer than 10000
bytes, an exploitable buffer overflow may occur.
III. ANALYSIS
Successful exploitation of this vulnerability would allow an
unauthenticated user to execute arbitrary commands on the affected
router with root privileges. This could allow any operation to be
performed on the router, including changing passwords and firewall
configuration, installation of new firmware with other features, or
denial of service. Exploitation of this vulnerability requires that an
attacker can connect to the web management port of the router. The
httpd is running by default but is only accessible via the LAN ports or
the WLAN (wireless LAN). An attacker who can associate via the wireless
interface to the network running a vulnerable httpd could send an
exploit from a wireless device, and so not require direct physical
access to an affected network. Additionally, if the httpd is configured
to listen on the WAN (internet) interface, this vulnerability would be
exploitable remotely over the internet.
On some versions of the WRT54G firmware the buffer used to store the
POST input, 'post_buf', is before a structure in memory containing
pointers to the 'mime_handlers' structure, which contains function
pointers for handling the various types of input. By overwriting this
structure so some function pointers point into post_buf, it is possible
to execute arbitrary commands. Overwriting these values with nulls will
prevent access to the httpd on the system until the router is
restarted. Overwriting these values with 'garbage' values will cause
the httpd to crash but it will be restarted by a system monitoring
process within 2 minutes, allowing multiple exploitation attempts.
Although authentication checks are performed on access to this page, the
code which reads in the buffer is executed even if authentication fails,
so as to clear the input buffer from the client before returning an
error message. This may allow an unauthenticated user to exploit the
vulnerability.
IV. DETECTION
iDEFENSE has confirmed the existence of this vulnerability in version
3.01.03 of the firmware of the Linksys WRT54G, and has identified the
same code is present in version 3.03.6. All versions prior to 4.20.7 may
be affected.
As this firmware is Open Source, and based on a reference implementation
supplied by the original hardware maker, there may be other affected 3rd
party firmware which use the same or similar code, and are thus also
affected.
V. WORKAROUND
In order to mitigate exposure of the internal network to outside
attackers, ensure encryption is enabled on the wireless interface. The
exact settings to use are dependent on your wireless deployment
policies.
VI. VENDOR RESPONSE
This vulnerability is addressed in firmware version 4.20.7 available for
download at:
http://www.linksys.com/servlet/Satellite?childpagename=US%2FLayout
&packedargs=c%3DL_Download_C2%26cid%3D1115417109974%26sku%3D112491680264
5
&pagename=Linksys%2FCommon%2FVisitorWrapper
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-2799 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
06/07/2005 Initial vendor notification
06/07/2005 Initial vendor response
09/13/2005 Coordinated public disclosure
IX. CREDIT
This vulnerability was discovered by Greg MacManus of iDEFENSE Labs.
Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
