Multiple Vendor Access Point Embedded HTTP Server Denial of Service Vulnerability

Bugtraq ID:	6090
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 01 2002 12:00AM
Updated:	Nov 01 2002 12:00AM
Credit:	Discovery of this vulnerability credited to "Mark Litchfield" <[email protected]>.
Vulnerable:	Linksys WAP11 1.4 Linksys WAP11 1.3 Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.42.7 Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.40.3 Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.37.9 b Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.37.2 b Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.37.2 Linksys BEFW11S4 1.4.2 .7 D-Link Dl-704 2.56 b6 D-Link Dl-704 2.56 b5 D-Link DI-804 4.68
Not Vulnerable:

Multiple Vendor Access Point Embedded HTTP Server Denial of Service Vulnerability

A denial of service vulnerability has been reported for several networking devices.

The condition will be triggered when the embedded web server, used by the devices, receives an overly long HTTP header. An attacker can exploit this vulnerability to cause the device to stop functioning.

Rebooting the device is necessary to restore functionality.

Although not yet confirmed, it has been speculated that this issue is a result of a buffer overflow.

Multiple Vendor Access Point Embedded HTTP Server Denial of Service Vulnerability

The following proof of concept was provided:

GET / HTTP/1.1
Host: <lots of characters>

Multiple Vendor Access Point Embedded HTTP Server Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Multiple Vendor Access Point Embedded HTTP Server Denial of Service Vulnerability

References:

• BEFVP41 Product Page (Linksys)
  
• Cable/DSL Routers Product Page (Linksys)
  
• Vendor Homepage (D-Link)