1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Multiple Linksys WRT54G Vulnerabilities

Discussion in 'Cisco/Linksys Wireless Routers' started by dpg, Sep 16, 2005.

  1. dpg

    dpg Network Guru Member

    Quoting from http://isc.sans.org/diary.php?storyid=674
    "iDefense has released five vulnerabilities against the Linksys WRT54G wireless access point/switch/router. Some of these vulnerabilities are very serious. Users of these products are highly recommended to patch their devices. "

    Does anyone know whether the various 3rd party firmware releases also suffer from these vulnerabilities?
     
  2. noble

    noble Network Guru Member

    hello same problem

    i am using one WRT54G withi hyperwrt and two wrt54gs with the orignal version from linksys.

    wich versions should I use for the router to be secure?

    thx
     
  3. ParanoidAndroid

    ParanoidAndroid Network Guru Member

    AFAIK these vulnerabilities are only locally exploitable, at least when you don't have remote management via the web interface open.
     
  4. noble

    noble Network Guru Member

    i have read the explanations but for me its not possible to switch off the wireless access to the admin interface.

    and a lot of users have access to the router cause some of them are located in an university - so a lot of funny people will try this exploit.

    most of them are running hyperwrt and this really cool firmware is based on the old 3.xxx firmware which has this exploits.

    so what should i do?
    updating to the new original firmware is for some routers possible but not for all.

    in this case - whicht non-original firmwares are fixed and which one make problems?
     
  5. littlewhoo

    littlewhoo Network Guru Member

    You can try to disable the webinterface completely, by killing the httpd deamon. This will not work with all firmwares. For example Alchemy is automatically restarting httpd if it's being killed. I don't know about HyperWRT. So give it a try.

    Administration of the WRT54G through the shell is a little bit more difficult than over the webinterface, but it's not impossible.

    I think at the moment only DD-WRT is fixed. And presumably OpenWRT isn't affected by the problem at all. I think OpenWRT has no webinterface and I don't know, if httpd is included at all in OpenWRT by default.
     
  6. noble

    noble Network Guru Member

    ok thanx for the infos, i will give the terminal a try

    but on some routers there are more people admins and not all are fit in using the command line.

    so i hopen hyperwrt will fix the problem as fast as possible.
     
  7. magnus33

    magnus33 Network Guru Member

    hyperwrt is total up tp date on the codebase if you check there forums you will find the firmwarefor even the latest.

    which is 4.20.8 for both the g and gs models.
     
  8. noble

    noble Network Guru Member

    oh thanks

    i cant find the infos - in this case i posted here.

    which version is the fixed one?
    or is every version fixed?
     

Share This Page