BID:6208

Multiple Linksys Devices Password Field Buffer Overflow Vulnerability

Info

Multiple Linksys Devices Password Field Buffer Overflow Vulnerability

Bugtraq ID:	6208
Class:	Boundary Condition Error
CVE:	CVE-2002-1312
Remote:	No
Local:	Yes
Published:	Nov 20 2002 12:00AM
Updated:	Jul 11 2009 07:16PM
Credit:	Discovery of this vulnerability credited to Alex S. Harasic ([email protected]).
Vulnerable:	Linksys HPRO200 1.42.7 Linksys EtherFast BEFSRU31 Router 1.43 Linksys EtherFast BEFSRU31 Router 1.42.7 Linksys EtherFast BEFSRU31 Router 1.42.3 Linksys EtherFast BEFSR81 Router 2.42.7 Linksys EtherFast BEFSR41 Router 1.43 Linksys EtherFast BEFSR41 Router 1.42.7 Linksys EtherFast BEFSR41 Router 1.42.3 Linksys EtherFast BEFSR11 Router 1.43 Linksys EtherFast BEFSR11 Router 1.42.7 Linksys EtherFast BEFSR11 Router 1.42.3 Linksys BEFW11S4 1.4.3 Linksys BEFW11S4 1.4.2 .7 Linksys BEFVP41 1.42.7 Linksys BEFSX41 1.42.7 Linksys BEFN2PS4 1.42.7

Not Vulnerable:	Linksys EtherFast BEFSRU31 Router 1.43.3 Linksys EtherFast BEFSR41 Router 1.43.3 Linksys EtherFast BEFSR11 Router 1.43.3 Linksys BEFW11S4 1.43.3

Discussion

Multiple Linksys Devices Password Field Buffer Overflow Vulnerability

Several Linksys Broadband Router devices are prone to a buffer overflow condition.

An attacker can exploit this vulnerability by issuing an overly long string for the Password field. When the device attempts to process the malformed input, it will crash. Remote exploitation is possible if the device is configured for remote management. However, remote management is disabled by default.

Rebooting the device is necessary to restore functionality.

Exploit / POC

Multiple Linksys Devices Password Field Buffer Overflow Vulnerability

There is no exploit code required.

Solution / Fix

Multiple Linksys Devices Password Field Buffer Overflow Vulnerability

Solution:
The following information has been reported as being from the vendor:

Until the updated firmware is released, we recommend that users downgrade the firmware to an earlier release, or minimize the risk of an attack by disabling remote management of the device.

Reports that fixed firmware for the v1 version of the BEFW11S4 router will not be released have been received.

This information has not been confirmed.

A new firmware revision is available:

Linksys BEFW11S4 1.4.2 .7