Details of VAR-201803-2171

ID

VAR-201803-2171

CVE

CVE-2018-7445

TITLE

MikroTik RouterOS Buffer Overflow Vulnerability

Trust: 0.8

sources: IVD: e2e6fb11-39ab-11e9-b68d-000c29342cb1 // CNVD: CNVD-2018-05801

DESCRIPTION

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable. MikroTik RouterOS Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. MikroTik RouterOS is a routing operating system developed by MikroTik based on the Linux kernel. By installing this system, standard x86 PC devices can be turned into professional routers. A buffer overflow vulnerability exists in MikroTik RouterOS 6.41.3 and earlier. MikroTik RouterOS is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts will result in denial-of-service conditions. This system turns a PC computer into a professional router. SMB service is one of the SMB (communication protocol) services

Trust: 2.79

sources: NVD: CVE-2018-7445 // JVNDB: JVNDB-2018-003373 // CNVD: CNVD-2018-05801 // BID: 103427 // IVD: e2e6fb11-39ab-11e9-b68d-000c29342cb1 // VULHUB: VHN-137477 // VULMON: CVE-2018-7445

IOT TAXONOMY

category:	['IoT', 'ICS']	sub_category:	-	Trust: 0.6
category:	['ICS']	sub_category:	-	Trust: 0.2

sources: IVD: e2e6fb11-39ab-11e9-b68d-000c29342cb1 // CNVD: CNVD-2018-05801

AFFECTED PRODUCTS

vendor:	routeros	model:	-	scope:	eq	version:	6.4.2	Trust: 2.6
vendor:	mikrotik	model:	routeros	scope:	eq	version:	6.4.2	Trust: 1.6
vendor:	mikrotik	model:	routeros	scope:	lt	version:	6.41.3	Trust: 1.0
vendor:	mikrotik	model:	routeros	scope:	lt	version:	6.41.3/6.42rc27	Trust: 0.8
vendor:	mikrotik	model:	routeros	scope:	lte	version:	<=6.41.3	Trust: 0.6
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.51	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.50	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.49	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.48	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.47	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.46	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.45	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.44	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.43	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.42	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.41	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	2.9.40	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	6.3	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	6.2	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	5.26	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	5.25	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	5.15	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	5.0	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	4.0	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	3.2	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	3.13	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	3.12	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	3.11	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	3.10	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	3.09	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	3.08	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	3.07	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	eq	version:	3.0	Trust: 0.3
vendor:	mikrotik	model:	routeros	scope:	ne	version:	6.41.3	Trust: 0.3
vendor:	mikrotik	model:	routeros 6.42rc27	scope:	ne	version:	-	Trust: 0.3
vendor:	routeros	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: e2e6fb11-39ab-11e9-b68d-000c29342cb1 // CNVD: CNVD-2018-05801 // BID: 103427 // JVNDB: JVNDB-2018-003373 // CNNVD: CNNVD-201803-658 // NVD: CVE-2018-7445

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-7445
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2018-7445
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2018-05801
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201803-658
value:	CRITICAL
Trust: 0.6
IVD:	e2e6fb11-39ab-11e9-b68d-000c29342cb1
value:	CRITICAL
Trust: 0.2
VULHUB:	VHN-137477
value:	HIGH
Trust: 0.1
VULMON:	CVE-2018-7445
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-7445
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2018-05801
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	e2e6fb11-39ab-11e9-b68d-000c29342cb1
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-137477
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-7445
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: IVD: e2e6fb11-39ab-11e9-b68d-000c29342cb1 // CNVD: CNVD-2018-05801 // VULHUB: VHN-137477 // VULMON: CVE-2018-7445 // JVNDB: JVNDB-2018-003373 // CNNVD: CNNVD-201803-658 // NVD: CVE-2018-7445

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-137477 // JVNDB: JVNDB-2018-003373 // NVD: CVE-2018-7445

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-658

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201803-658

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-003373

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-137477 // VULMON: CVE-2018-7445

PATCH

title:	Top Page	url:	https://mikrotik.com/	Trust: 0.8
title:	MikroTik RouterOS Buffer Overflow Vulnerability Patch	url:	https://www.cnvd.org.cn/patchInfo/show/122363	Trust: 0.6
title:	MikroTik RouterOS SMB service Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79277	Trust: 0.6
title:	Chimay-Blue	url:	https://github.com/BigNerd95/Chimay-Blue	Trust: 0.1
title:	fuzzing-stuff	url:	https://github.com/alphaSeclab/fuzzing-stuff	Trust: 0.1
title:	Securelist	url:	https://securelist.com/apt-trends-report-q1-2018/85280/	Trust: 0.1

sources: CNVD: CNVD-2018-05801 // VULMON: CVE-2018-7445 // JVNDB: JVNDB-2018-003373 // CNNVD: CNNVD-201803-658

EXTERNAL IDS

db:	NVD	id:	CVE-2018-7445	Trust: 3.7
db:	BID	id:	103427	Trust: 1.5
db:	EXPLOIT-DB	id:	44290	Trust: 1.2
db:	CNNVD	id:	CNNVD-201803-658	Trust: 0.9
db:	CNVD	id:	CNVD-2018-05801	Trust: 0.8
db:	JVNDB	id:	JVNDB-2018-003373	Trust: 0.8
db:	CXSECURITY	id:	WLB-2018030146	Trust: 0.6
db:	IVD	id:	E2E6FB11-39AB-11E9-B68D-000C29342CB1	Trust: 0.2
db:	SEEBUG	id:	SSVID-97182	Trust: 0.1
db:	PACKETSTORM	id:	146795	Trust: 0.1
db:	VULHUB	id:	VHN-137477	Trust: 0.1
db:	VULMON	id:	CVE-2018-7445	Trust: 0.1

sources: IVD: e2e6fb11-39ab-11e9-b68d-000c29342cb1 // CNVD: CNVD-2018-05801 // VULHUB: VHN-137477 // VULMON: CVE-2018-7445 // BID: 103427 // JVNDB: JVNDB-2018-003373 // CNNVD: CNNVD-201803-658 // NVD: CVE-2018-7445

REFERENCES

url:	https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow	Trust: 2.1
url:	http://seclists.org/fulldisclosure/2018/mar/38	Trust: 2.0
url:	http://www.securityfocus.com/bid/103427	Trust: 1.3
url:	https://www.exploit-db.com/exploits/44290/	Trust: 1.3
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7445	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-7445	Trust: 0.8
url:	https://cxsecurity.com/issue/wlb-2018030146	Trust: 0.6
url:	https://mikrotik.com/download	Trust: 0.3
url:	http://www.mikrotik.com/software.html	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/119.html	Trust: 0.1
url:	https://github.com/bignerd95/chimay-blue	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2018-05801 // VULHUB: VHN-137477 // VULMON: CVE-2018-7445 // BID: 103427 // JVNDB: JVNDB-2018-003373 // CNNVD: CNNVD-201803-658 // NVD: CVE-2018-7445

CREDITS

Core Security Technologies

Trust: 0.6

sources: CNNVD: CNNVD-201803-658

SOURCES

db:	IVD	id:	e2e6fb11-39ab-11e9-b68d-000c29342cb1
db:	CNVD	id:	CNVD-2018-05801
db:	VULHUB	id:	VHN-137477
db:	VULMON	id:	CVE-2018-7445
db:	BID	id:	103427
db:	JVNDB	id:	JVNDB-2018-003373
db:	CNNVD	id:	CNNVD-201803-658
db:	NVD	id:	CVE-2018-7445

LAST UPDATE DATE

2024-08-14T15:23:32.978000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-05801	date:	2018-03-22T00:00:00
db:	VULHUB	id:	VHN-137477	date:	2018-04-24T00:00:00
db:	VULMON	id:	CVE-2018-7445	date:	2018-04-24T00:00:00
db:	BID	id:	103427	date:	2018-03-15T00:00:00
db:	JVNDB	id:	JVNDB-2018-003373	date:	2018-05-23T00:00:00
db:	CNNVD	id:	CNNVD-201803-658	date:	2021-08-18T00:00:00
db:	NVD	id:	CVE-2018-7445	date:	2018-04-24T14:53:44.183

SOURCES RELEASE DATE

db:	IVD	id:	e2e6fb11-39ab-11e9-b68d-000c29342cb1	date:	2018-03-20T00:00:00
db:	CNVD	id:	CNVD-2018-05801	date:	2018-03-20T00:00:00
db:	VULHUB	id:	VHN-137477	date:	2018-03-19T00:00:00
db:	VULMON	id:	CVE-2018-7445	date:	2018-03-19T00:00:00
db:	BID	id:	103427	date:	2018-03-15T00:00:00
db:	JVNDB	id:	JVNDB-2018-003373	date:	2018-05-23T00:00:00
db:	CNNVD	id:	CNNVD-201803-658	date:	2018-03-20T00:00:00
db:	NVD	id:	CVE-2018-7445	date:	2018-03-19T21:29:01.083