Linksys Router Unauthorized Management Access Vulnerability

Bugtraq ID:	6201
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 18 2002 12:00AM
Updated:	Nov 18 2002 12:00AM
Credit:	Discovery credited to Seth Bromberger <[email protected]>.
Vulnerable:	Linksys EtherFast BEFSRU31 Router 1.43 Linksys EtherFast BEFSRU31 Router 1.42.7 Linksys EtherFast BEFSRU31 Router 1.42.3 Linksys EtherFast BEFSRU31 Router 1.41 Linksys EtherFast BEFSR41 Router 1.43 Linksys EtherFast BEFSR41 Router 1.42.7 Linksys EtherFast BEFSR41 Router 1.42.3 Linksys EtherFast BEFSR41 Router 1.41 Linksys EtherFast BEFSR11 Router 1.43 Linksys EtherFast BEFSR11 Router 1.42.7 Linksys EtherFast BEFSR11 Router 1.42.3 Linksys EtherFast BEFSR11 Router 1.41 Linksys BEFW11S4 1.4.3 Linksys BEFW11S4 1.4.2 .7
Not Vulnerable:	Linksys EtherFast BEFSR41 Router 1.43.3

Linksys Router Unauthorized Management Access Vulnerability

The following proof of concept has been supplied.


- BEFSR41 firewall/router with firmware version 1.43
- lynx browser version 2.8.4rel.1 (17 Jul 2001)
- ~/.mailcap with the following line:
application/foo.xml;

Using lynx with the above mailcap, connect to the management interface (remote interface listens on port 8080 when enabled). Affected versions will display the setup screen without requiring the user to enter a password. (Note: mailcap is generally installed as ~/.mailcap). Navigation to other screens is possible, though some "accept" buttons might not render if the browser used is unable to process javascript.

Linksys Router Unauthorized Management Access Vulnerability

Solution:
Linksys has been notified and updated firmware has been released.

Linksys Router Unauthorized Management Access Vulnerability

References:

• Driver Downloads (Linksys)
  
• Linksys router vulnerability (Seth Bromberger )
  
• UPDATE: Linksys router vulnerability (add'l models affected) (Seth Bromberger )