----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Linksys WRT54G Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA16806

VERIFY ADVISORY:
http://secunia.com/advisories/16806/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass, DoS, System access

WHERE:
>From local network

OPERATING SYSTEM:
Linksys WRT54G Wireless-G Broadband Router
http://secunia.com/product/3523/

DESCRIPTION:
Greg MacManus has reported some vulnerabilities in WRT54G, which can
be exploited malicious people to bypass certain security
restrictions, cause a DoS (Denial of Service), or compromise a
vulnerable system.

1) A validation error exists in the "POST" method handlers of the
built-in web management httpd server when handing a negative
"Content-Length" value. This can be exploited to cause the httpd to
become unresponsive, and may cause the web management interface to be
unavailable.

The vulnerability has been reported in firmware version 3.01.3,
3.03.6 and 4.00.7. All versions prior to 4.20.7 may also be
affected.

2) A design error in upgrade.cgi can be exploited by an
unauthenticated user to upload arbitrary firmware onto the router.
The uploaded firmware will be saved on the router but will not take
effect until the router is rebooted.

The vulnerability has been reported in firmware version 3.01.3,
3.03.6 and 4.00.7. All versions prior to 4.20.7 may also be
affected.

3) A design error in restore.cgi can be exploited by an
unauthenticated user to upload arbitrary configuration settings to
router. The uploaded configuration settings will be saved on the
router but will not take effect until the router is rebooted.

The vulnerability has been reported in firmware version 3.01.3,
3.03.6 and 4.00.7. All versions prior to 4.20.7 may also be
affected.

4) The vulnerability is caused due to a boundary error in apply.cgi
when sending a POST request to the page with a content length longer
than 10000 bytes. This can be exploited to crash httpd and cause the
web management interface to become unavailable, and may allow code
execution with root privileges.

The vulnerability has been reported in firmware version 3.01.3 and
3.03.6. All versions prior to 4.20.7 may also be affected.

5) An authentication error in ezconfig.asp can be exploited by
unauthenticated users to upload configuration settings to a
vulnerable device if the fixed 256-byte XOR key used to encrypt the
settings is known.

The vulnerability has been reported in firmware version 3.01.3 and
3.03.6.

Successful exploitation of the vulnerabilities requires the ability
to connect to the web management interface.

SOLUTION:
Update firmware to version 4.20.7.

PROVIDED AND/OR DISCOVERED BY:
Greg MacManus, iDEFENSE Labs.

ORIGINAL ADVISORY:
iDEFENSE:
http://www.idefense.com/application/poi/display?id=308&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=307&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=306&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=305&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=304&type=vulnerabilities

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------