Vulnerability

    Winroute

Affected

    Winroute 3.04a..g

Description

    Michael R. Rudel found  following.  There is  a bug in the  remote
    proxy server admin  part of Winroute  3.04g (tested on  an earlier
    release (3.04a),  and that  is also  vulnerable).   When you first
    access the admin proxy server, it asks for a username and password
    to authenticate to.  If you hit 'cancel', one frame will come back
    as not containing  any data, but  the other frame  will still give
    you all  the buttons  that you  need to  configure the  software -
    giving you full access.   This is a semisortakindaserious bug,  as
    anyone using  Winroute can  be disconnected  from the  Internet by
    anyone else in  the world, as  they can authenticate  to the admin
    proxy server without a user name and password.  Max Vision same on
    Confirmed on Winroute Pro 3.04:

        http://localhost:3129/admin/config/

    takes  you   straight  to   the  configuration   options   without
    authentication.  An unrelated bug is that the packetfilter refuses
    to  pass  on  tcp   139  regardless  of  implicite   configuration
    otherwise.

Solution

    If one is going to use Winroute, it is highly recommended  turning
    on the packet filter found at Settings -> Advanced -> Packetfilter