[NEWS] Linksys Cable/DSL 4port Exposure Issue

From: support@securiteam.com
Date: 06/09/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Sun,  9 Jun 2002 20:34:15 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Linksys Cable/DSL 4port Exposure Issue
------------------------------------------------------------------------

SUMMARY

 <http://www.linksys.com/> Linksys Cable/DSL has been found to contain a
security vulnerability that occurs when an administrator flashes (updates
the firmware) the product to the latest version. The vulnerability would
allow remote administration even if it has been specifically disabled in
the product (The administration will be available via a different port
than the normal administration port).

DETAILS

Vulnerable systems:
Linksys Cable/DSL version 1.42.7 (BEFSR11 / BEFSR41 / BEFSRU31)

Immune systems:
Linksys Cable/DSL versions prior to 1.42.7 (BEFSR11 / BEFSR41 / BEFSRU31)

After flashing the Linksys Cable/DSL with the new firmware (Version 1.42.7
that was released on May 1 2002), a new port will open for remote
administration, TCP port 5678. This port will open even if the "Block WAN"
and "Remote Admin" are set to disabled.

ADDITIONAL INFORMATION

The information has been provided by <mailto:timm2000@cableone.net> Tim
Mayville.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages
Loading