Re: LinkSys WRT54G administration page availble to WAN

["Matthew Gillespie" <mgillespie () socket net>]

Alan,

 I have personally contacted Linksys in regards to this problem (it appears
that a glitch in WRT54G and in BEFSR41v3 cause this problem). Both pieces of
equipment were running current firmware (I don't have my notes with me at
the moment, but the firmware was current). And in both instances remote
admin was available via port 80 on the WAN side.

 Initially I spoke with an outsourced group of individuals that recommended
I forward port 80 inquiries to a null ip. This DOES work, however is very
sloppy. Later I asked for the source code to BEFSR41v3, to modify the bug
myself but was denied as it is propietary.

 After repeated problems with remote admin STAYING on (keep in mind, it was
disabled, along with various other settings) I again contacted linksys where
a friendly individual informed me, "If you continue to have the problem you
could just buy a new router".

 All of this is documented in emails I have sent to Linksys. I have spoken
to Jason Hardy throughout April (Linksys Product Support Case#: 2423404 and
RE: Linksys Product Support Case#: 242340) however the issue has yet to be
resolved.

 So I'd suggest forwarding port 80 inquries to a null ip in the meantime,
good work Linksys.


----- Original Message ----- 
From: "Alan W. Rateliff, II" <lists () rateliff net>
To: <bugtraq () securityfocus com>
Sent: Monday, May 31, 2004 11:51 AM
Subject: LinkSys WRT54G administration page availble to WAN


> Manufacturer: LinkSys (a division of Cisco)
> Product: Wireless-G Broadband Router
> Model: WRT54G
> Product Page:
> http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=601
> Firmware tested: v2.02.7
>
> In a recent client installation I discovered that even if the remote
> administration function is turned off, the WRT54G provides the
> administration web page to ports 80 and 443 on the WAN.  The implications
> are obvious: out of the box the unit gives full access to its
administration
> from the WAN using the default or, if the user even bothered to change it,
> an easily guessed password.
>
> I reported this to LinkSys (along with a number of other non-security
> related issues) on April 28.  I received no reponse addressing this, and
no
> updated firmware has yet appeared on their firmware page
> http://www.linksys.com/download/firmware.asp?fwid=201
>
> To work around this, you can use the port forwarding (irritatingly renamed
> to Games and whatever) to send ports 80 and 443 to non-existant hosts.
Note
> that forwarding the ports to any hosts -- inluding listening ones if you
are
> actually running servers -- will override the default behavior.
>
> On a personal note, there are a number of reasons for which I am
thoroughly
> disappointed with LinkSys since the acquisition by Cisco.  For the sake of
> what was once a rock-solid product and great brand name, I hope things
> change soon.
>
> -- 
>        Alan W. Rateliff, II        :       RATELIFF.NET
>  Independent Technology Consultant :    alan2 () rateliff net
>       (Office) 850/350-0260        :  (Mobile) 850/559-0100
> -------------------------------------------------------------
> [System Administration][IT Consulting][Computer Sales/Repair]