UPNP Security flaw.

Discussion in 'Asuswrt-Merlin' started by Bagman, Jan 30, 2013.

  1. Bagman

    Bagman Regular Contributor

    Joined:
    Nov 30, 2012
    Messages:
    70
    From this article:

    RT-N66U, RT-AC66U and other Asus routers are exposing SOAP to the internet according to this list.

    Is Merlin's build vulnerable, and can you do a quick fix by updating to the newer versions of miniUPnP and UPnP?
     
  2. Log in / Register to remove this ad

  3. octopus

    octopus Senior Member

    Joined:
    Jul 17, 2012
    Messages:
    353
  4. dannytill

    dannytill New Around Here

    Joined:
    Jan 24, 2013
    Messages:
    3
  5. RMerlin

    RMerlin Part of the Furniture

    Joined:
    Apr 14, 2012
    Messages:
    13,715
    Location:
    Canada
    Asuswrt still uses an older version of Miniupnpd (1.4, versus the 1.6 version used by Tomato). Tomato only upgraded theirs after Asuswrt had forked from them.

    I started looking at upgrading miniupnpd, but my first attempt at going all the way to 1.7 didn't work too well (I need to upgrade it through patching, since Asuswrt's version is somewhat customized versus the original version, and the resulting patched tree would have many build issues).

    I'll see into getting it upgraded for the next build 24 beta, so it can get good testing at the same time.
     
  6. Bagman

    Bagman Regular Contributor

    Joined:
    Nov 30, 2012
    Messages:
    70
    Thanks for looking into this Merlin. Now that all the info about these loopholes is out in the open, it seems like only a matter of time before they are targeted by worms/viruses. If you can upgrade the problem components and keep our routers secure, it's just another (major) reason why your firmware is better than the Asus firmware.
     
  7. Nerre

    Nerre Senior Member

    Joined:
    Oct 17, 2012
    Messages:
    313
    But does the miniUPnP issue mean it is vulnerable against external attacks or just attacks from the inside?

    I thought external attacks would be prevented by sufficient iptables rules?
     
  8. Bagman

    Bagman Regular Contributor

    Joined:
    Nov 30, 2012
    Messages:
    70
    Read the article - external attacks because the default IPtables rules are not adequately implemented.

    What annoys me is some of this stuff has been fixed for years, but big companies like Asus (who should know better) are still using code from 2008. All the have to do is update the relevant modules with ones that are now available.
     
  9. RMerlin

    RMerlin Part of the Furniture

    Joined:
    Apr 14, 2012
    Messages:
    13,715
    Location:
    Canada
    At this point, it's unsure if Asuswrt is vulnerable or not. While Asus runs an older miniupnpd, they tend to regularily backport security fixes from upstream, so it's possible they might have patched that flaw already.

    Again: unless someone actually test it, it's unsure if it's vunlerable or not. I just want to play it safe on my end, and try to get miniupnpd upgraded to at least version 1.6 (I'll port the Tomato version if needs be, since I don't think Asus has done many changes since the original fork from Tomato).
     
  10. got_milk

    got_milk Regular Contributor

    Joined:
    Jun 19, 2012
    Messages:
    159
    Whether miniupnpd itself is vulnerable or not I'm not sure yet, but it doesn't appear that Asuswrt exposes miniupnpd to the WAN interface (some probing from an external server using nmap shows no responses to my attempts). Even if miniupnpd were vulnerable to such attacks, they would definitely require access to the internal LAN to start, and if you have access to the internal LAN, why would you need to exploit miniupnpd. ;)

    This post also seems to indicate that Asus has patched miniupnpd to fix these vulnerabilities.
     
  11. Bagman

    Bagman Regular Contributor

    Joined:
    Nov 30, 2012
    Messages:
    70
    I just installed Java and the Rapid 7 scan test. It identifies my RT-N66U running the latest Merlin beta as a UPnP device, but says it's not exploitable. I get the same results as KevTech does in the link in the post above.

    Maybe Asus has patched the vulnerability even though they've patched to the older UPnP 1 that is listed as vulnerable?
     
  12. RMerlin

    RMerlin Part of the Furniture

    Joined:
    Apr 14, 2012
    Messages:
    13,715
    Location:
    Canada
    That wouldn't surprise me. They do a lot of upstream backporting. That means minimal risk of breaking something, unlike if they were to fully upgrade the whole software.
     
  13. sfx2000

    sfx2000 Part of the Furniture

    Joined:
    Aug 11, 2011
    Messages:
    2,028
    Location:
    San Diego, CA
  14. RMerlin

    RMerlin Part of the Furniture

    Joined:
    Apr 14, 2012
    Messages:
    13,715
    Location:
    Canada
    Just to reiterate: Asuswrt is NOT vulnerable. In fact, it doesn't even use the mentionned upnp stack, but relies on Miniupnpd.

    This is (IMHO) another security research company trying to blow out of proportion a security hole that only affects certain routers, and fail to actually mention which ones are affected. Not every router out there runs the Broadcom stack (and some don't even use Broadcom).
     
  15. MintyTrebor

    MintyTrebor New Around Here

    Joined:
    Jan 15, 2013
    Messages:
    2
    For those who want independent confirmation, or who also run other model routers, the Shields Up firewall testing service @ www.grc.com, has been updated to incorporate a probe for these vulnerabilities (no install or registration required, all done from a web page).

    It also includes a link to a Security Now podcast which explains the issue, for those who want more info.
     

Share This Page