Multiple Linksys Devices DHCP Information Disclosure and Denial of Service Vulnerability

Bugtraq ID:	10329
Class:	Design Error
CVE:	CVE-2004-0580 CVE-2004-0580
Remote:	Yes
Local:	No
Published:	May 13 2004 12:00AM
Updated:	Mar 19 2015 09:44AM
Credit:	Jon Hart <[email protected]> is credited for discovery.
Vulnerable:	Linksys WRT54G v2.0 2.0 0.8 (Firmware) Linksys WPC300N - Wireless-N Notebook Adapter 4.100.15.5 Linksys WAP55AG 1.0.7 Linksys RV082 Linksys EtherFast BEFVP41 Router 1.39.64 Linksys EtherFast BEFVP41 Router Linksys EtherFast BEFSRU31 Router 1.44 Linksys EtherFast BEFSRU31 Router 1.43.3 Linksys EtherFast BEFSRU31 Router 1.43 Linksys EtherFast BEFSRU31 Router 1.42.7 Linksys EtherFast BEFSRU31 Router 1.42.3 Linksys EtherFast BEFSRU31 Router 1.41 Linksys EtherFast BEFSRU31 Router 1.40.2 Linksys EtherFast BEFSR81 Router 2.44 Linksys EtherFast BEFSR81 Router 2.42.7 Linksys EtherFast BEFSR81 Router 2.42.7.1 Linksys EtherFast BEFSR81 Router Linksys EtherFast BEFSR41 Router 1.45.7 Linksys EtherFast BEFSR41 Router 1.44 Linksys EtherFast BEFSR41 Router 1.43.3 Linksys EtherFast BEFSR41 Router 1.43 Linksys EtherFast BEFSR41 Router 1.42.7 Linksys EtherFast BEFSR41 Router 1.42.3 Linksys EtherFast BEFSR41 Router 1.41 Linksys EtherFast BEFSR41 Router 1.40.2 Linksys EtherFast BEFSR41 Router 1.39 Linksys EtherFast BEFSR41 Router 1.38 Linksys EtherFast BEFSR41 Router 1.37 Linksys EtherFast BEFSR41 Router 1.36 Linksys EtherFast BEFSR41 Router 1.35 Linksys EtherFast BEFSR41 Router 1.38.5 Linksys EtherFast BEFSR11 Router 1.44 Linksys EtherFast BEFSR11 Router 1.43.3 Linksys EtherFast BEFSR11 Router 1.43 Linksys EtherFast BEFSR11 Router 1.42.7 Linksys EtherFast BEFSR11 Router 1.42.3 Linksys EtherFast BEFSR11 Router 1.41 Linksys EtherFast BEFSR11 Router 1.40.2 Linksys EtherFast BEFN2PS4 Router Linksys BEFVP41 1.42.7 Linksys BEFVP41 1.40 .4 Linksys BEFVP41 1.40 .3f Linksys BEFSX41 1.45.3 Linksys BEFSX41 1.44.3 Linksys BEFSX41 1.44 Linksys BEFSX41 1.43.4 Linksys BEFSX41 1.43.3 Linksys BEFSX41 1.43 Linksys BEFSX41 1.42.7 Linksys BEFSR81 Linksys BEFSR41W Linksys BEFN2PS4 1.42.7 Linksys BEFCMU10
Not Vulnerable:	Linksys EtherFast BEFSR41 Router 1.0 5.00

Multiple Linksys Devices DHCP Information Disclosure and Denial of Service Vulnerability

It has been reported that the built-in DHCP server on these devices are prone to an information disclosure vulnerability. When attempting to exploit this issue, it has been reported that a denial of service condition may occur, stopping legitimate users from using the device.

The DHCP server application on the device reportedly does not handle BOOTP packets properly, and can disclose the contents of the devices memory to an attacker. It may be possible for an attacker to use this vulnerability to watch traffic on an affected device. It may also be possible for an attacker to crash the device and deny service to legitimate users.

Multiple Linksys Devices DHCP Information Disclosure and Denial of Service Vulnerability

An exploit has been provided by Jon Hart <[email protected]>.

• /data/vulnerabilities/exploits/linksys-dhcp-exploit.c

Multiple Linksys Devices DHCP Information Disclosure and Denial of Service Vulnerability

Solution:
Upgrade to firmware version 1.05.00 for BEFSR41. Other firmware upgrades may be available for other devices.

Currently we are not aware of any other vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Multiple Linksys Devices DHCP Information Disclosure and Denial of Service Vulnerability

References:

• BEFSR41 V1, V2, and V3 DHCP Server and BOOTP Packet Vulnerability (Linksys)
  
• Cable/DSL Routers Product Page (Linksys)
  
• Linksys Homepage (Cisco)
  
• Linksys BEFSR41 DHCP vulnerability server leaks network data (Lance Armstrong )