
A.3 Linksys
A.3.1 WRT54G and WRT54GS
model firmware device NAT bug
WRT54G v2.2 3.03.9 wireless gateway/router yes
WRT54G v2.2 4.20.7 wireless gateway/router yes
WRT54G v2.2 4.20.8 wireless gateway/router yes
WRT54GS v1.0 2.09.1 wireless gateway/router yes
WRT54GS v1.0 4.70.6 wireless gateway/router yes
The WRT54G is a wireless gateway with built-in router, which is based on Linux
2
and uses the Broadcom UPnP implementation. This implementation – at least in all
versions of the firmware that were tested – is flawed because the InternalMachine
parameter to AddPortMapping is not checked before a port mapping is established.
If InternalMachine points to a machine that’s not on the internal network, IP
packets will still go through NAT and have their IP header rewritten, so it seems
all traffic comes from the router.
Linksys was notified in early february and acknowledged the bug. A new firmware
with a fix was not yet publicly available before the deadline for this paper.
A.3.2 BEFW11S4
model firmware device NAT bug
BEFW11S4 v4 1.45.3 wireless gateway/router no
BEFW11S4 v4 1.52.02 wireless gateway/router no
The BEFW11S4 displays some interesting behaviour. First if all, the scripts as
described in this paper do not seem to work at all. Even requesting a “normal”
portmapping (to the requesting machine itself) does not work.
When a list of existing portmappings is asked with the GetGenericPortMappingEntry
SOAP action, it only returns one portmapping over and over again, namely the
mapping that’s already preset in the device for FTP. No matter wat value of the
NewPortMappingIndex to GetGenericPortMappingEntry is taken, the result is al-
ways the same.
Another bug with the same SOAP action only manifests itself in the 1.45.3 firmware,
but not in the 1.52.0.2 firmware. When in a short period of time (several seconds)
a large list of portmappings is requested, the router overloads and drops all connec-
tions to the outside, but the internal switch module still seems to work. Ethereal
shows TCP retransmissions, TCP out of order and duplicate ACKs packets.
import os
from SOAPpy import *
endpoint = "http://192.168.1.1:2468/WANIPConnection"
soapaction = "urn:schemas-upnp-org:service:WANIPConnection:1#GetGenericPortMappingEntry"
i=0
2
This is not true anymore. Starting with hardware revision 5 of the WRT54G Linksys has
chosen to use VxWorks. The motherboard has much less memory and RAM than previous versions.
However, a new version, the WRT54GL, is nearly identical to previous versions, and is targeted
for people who want to modify their router.
Comentarios a estos manuales