Details of VAR-201906-0777

ID

VAR-201906-0777

CVE

CVE-2017-8336

TITLE

plural Securifi Almond Device firmware buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-014535

DESCRIPTION

An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding new routes to the device. It seems that the POST parameters passed in this request to set up routes on the device can be set in such a way that would result in overflowing the stack set up and allow an attacker to control the $ra register stored on the stack. If the firmware version AL-R096 is dissected using binwalk tool, we obtain a cpio-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "goahead" is the one that has the vulnerable function that recieves the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows a MIPS little endian format. The function sub_00420F38 in IDA pro is identified to be receiving the values sent in the POST request. The POST parameter "gateway" allows to overflow the stack and control the $ra register after 1546 characters. The value from this post parameter is then copied on the stack at address 0x00421348 as shown below. This allows an attacker to provide the payload of his/her choice and finally take control of the device. Securifi Almond , Almond+ , Almond 2015 The device firmware contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Securifi Almond is a wireless router with a touch screen

Trust: 1.8

sources: NVD: CVE-2017-8336 // JVNDB: JVNDB-2017-014535 // VULHUB: VHN-116539 // VULMON: CVE-2017-8336

AFFECTED PRODUCTS

vendor:	securifi	model:	almond 2015	scope:	eq	version:	al-r096	Trust: 1.8
vendor:	securifi	model:	almond	scope:	eq	version:	al-r096	Trust: 1.8
vendor:	securifi	model:	almond\+	scope:	eq	version:	al-r096	Trust: 1.0
vendor:	securifi	model:	almond+	scope:	eq	version:	al-r096	Trust: 0.8

sources: JVNDB: JVNDB-2017-014535 // NVD: CVE-2017-8336

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-8336
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-8336
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201705-020
value:	HIGH
Trust: 0.6
VULHUB:	VHN-116539
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2017-8336
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-8336
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-116539
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-8336
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-116539 // VULMON: CVE-2017-8336 // JVNDB: JVNDB-2017-014535 // CNNVD: CNNVD-201705-020 // NVD: CVE-2017-8336

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-116539 // JVNDB: JVNDB-2017-014535 // NVD: CVE-2017-8336

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201705-020

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201705-020

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-014535

PATCH

title:	almond	url:	https://www.securifi.com/ja/almond	Trust: 0.8
title:	almondplus	url:	https://www.securifi.com/ja/almondplus	Trust: 0.8
title:	almond-2015	url:	https://www.securifi.com/ja/almond-2015	Trust: 0.8
title:	Securifi Almond Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=93910	Trust: 0.6
title:	IoT_vulnerabilities	url:	https://github.com/ethanhunnt/IoT_vulnerabilities	Trust: 0.1

sources: VULMON: CVE-2017-8336 // JVNDB: JVNDB-2017-014535 // CNNVD: CNNVD-201705-020

EXTERNAL IDS

db:	NVD	id:	CVE-2017-8336	Trust: 2.7
db:	PACKETSTORM	id:	153227	Trust: 1.9
db:	JVNDB	id:	JVNDB-2017-014535	Trust: 0.8
db:	CNNVD	id:	CNNVD-201705-020	Trust: 0.7
db:	VULHUB	id:	VHN-116539	Trust: 0.1
db:	VULMON	id:	CVE-2017-8336	Trust: 0.1

sources: VULHUB: VHN-116539 // VULMON: CVE-2017-8336 // JVNDB: JVNDB-2017-014535 // PACKETSTORM: 153227 // CNNVD: CNNVD-201705-020 // NVD: CVE-2017-8336

REFERENCES

url:	https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/securifi_almond_plus_sec_issues.pdf	Trust: 2.6
url:	https://seclists.org/bugtraq/2019/jun/8	Trust: 1.8
url:	http://packetstormsecurity.com/files/153227/securifi-almond-2015-buffer-overflow-command-injection-xss-csrf.html	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8336	Trust: 1.5
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8336	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/119.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/ethanhunnt/iot_vulnerabilities	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8330	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8333	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8335	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8329	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8337	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8328	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8331	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8334	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-8332	Trust: 0.1

sources: VULHUB: VHN-116539 // VULMON: CVE-2017-8336 // JVNDB: JVNDB-2017-014535 // PACKETSTORM: 153227 // CNNVD: CNNVD-201705-020 // NVD: CVE-2017-8336

CREDITS

Mandar Satam

Trust: 0.1

sources: PACKETSTORM: 153227

SOURCES

db:	VULHUB	id:	VHN-116539
db:	VULMON	id:	CVE-2017-8336
db:	JVNDB	id:	JVNDB-2017-014535
db:	PACKETSTORM	id:	153227
db:	CNNVD	id:	CNNVD-201705-020
db:	NVD	id:	CVE-2017-8336

LAST UPDATE DATE

2024-11-23T21:52:10.367000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-116539	date:	2019-06-21T00:00:00
db:	VULMON	id:	CVE-2017-8336	date:	2019-06-21T00:00:00
db:	JVNDB	id:	JVNDB-2017-014535	date:	2019-06-25T00:00:00
db:	CNNVD	id:	CNNVD-201705-020	date:	2019-06-24T00:00:00
db:	NVD	id:	CVE-2017-8336	date:	2024-11-21T03:33:47.417

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-116539	date:	2019-06-18T00:00:00
db:	VULMON	id:	CVE-2017-8336	date:	2019-06-18T00:00:00
db:	JVNDB	id:	JVNDB-2017-014535	date:	2019-06-25T00:00:00
db:	PACKETSTORM	id:	153227	date:	2019-06-07T15:06:02
db:	CNNVD	id:	CNNVD-201705-020	date:	2017-04-29T00:00:00
db:	NVD	id:	CVE-2017-8336	date:	2019-06-18T19:15:10.827