bugtraq - Re: LinkSys WRT54G administration page availble to WAN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 1 Jun 2004 08:28:30 -0500
From: "Matthew Gillespie" <mgillespie@...ket.net>
To: "Alan W. Rateliff, II" <lists@...eliff.net>
Cc: <bugtraq@...urityfocus.com>
Subject: Re: LinkSys WRT54G administration page availble to WAN

Alan,

 I have personally contacted Linksys in regards to this problem (it appears
that a glitch in WRT54G and in BEFSR41v3 cause this problem). Both pieces of
equipment were running current firmware (I don't have my notes with me at
the moment, but the firmware was current). And in both instances remote
admin was available via port 80 on the WAN side.

 Initially I spoke with an outsourced group of individuals that recommended
I forward port 80 inquiries to a null ip. This DOES work, however is very
sloppy. Later I asked for the source code to BEFSR41v3, to modify the bug
myself but was denied as it is propietary.

 After repeated problems with remote admin STAYING on (keep in mind, it was
disabled, along with various other settings) I again contacted linksys where
a friendly individual informed me, "If you continue to have the problem you
could just buy a new router".

 All of this is documented in emails I have sent to Linksys. I have spoken
to Jason Hardy throughout April (Linksys Product Support Case#: 2423404 and
RE: Linksys Product Support Case#: 242340) however the issue has yet to be
resolved.

 So I'd suggest forwarding port 80 inquries to a null ip in the meantime,
good work Linksys.

----- Original Message ----- 
From: "Alan W. Rateliff, II" <lists@...eliff.net>
To: <bugtraq@...urityfocus.com>
Sent: Monday, May 31, 2004 11:51 AM
Subject: LinkSys WRT54G administration page availble to WAN

> Manufacturer: LinkSys (a division of Cisco)
> Product: Wireless-G Broadband Router
> Model: WRT54G
> Product Page:
> http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=601
> Firmware tested: v2.02.7
>
> In a recent client installation I discovered that even if the remote
> administration function is turned off, the WRT54G provides the
> administration web page to ports 80 and 443 on the WAN.  The implications
> are obvious: out of the box the unit gives full access to its
administration
> from the WAN using the default or, if the user even bothered to change it,
> an easily guessed password.
>
> I reported this to LinkSys (along with a number of other non-security
> related issues) on April 28.  I received no reponse addressing this, and
no
> updated firmware has yet appeared on their firmware page
> http://www.linksys.com/download/firmware.asp?fwid=201
>
> To work around this, you can use the port forwarding (irritatingly renamed
> to Games and whatever) to send ports 80 and 443 to non-existant hosts.
Note
> that forwarding the ports to any hosts -- inluding listening ones if you
are
> actually running servers -- will override the default behavior.
>
> On a personal note, there are a number of reasons for which I am
thoroughly
> disappointed with LinkSys since the acquisition by Cisco.  For the sake of
> what was once a rock-solid product and great brand name, I hope things
> change soon.
>
> -- 
>        Alan W. Rateliff, II        :       RATELIFF.NET
>  Independent Technology Consultant :    alan2@...eliff.net
>       (Office) 850/350-0260        :  (Mobile) 850/559-0100
> -------------------------------------------------------------
> [System Administration][IT Consulting][Computer Sales/Repair]
>
>
>
>
>