Sign-up

ID

VAR-201907-1076


CVE

CVE-2017-8416


TITLE

D-Link DCS-1100 and DCS-1130 Device buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-014560

DESCRIPTION

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding. D-Link DCS-1100 and DCS-1130 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDCS-1100 and D-LinkDCS-1130 are both network cameras from D-Link Corporation of Taiwan, China. A buffer error vulnerability exists in the D-LinkDCS-1100 and DCS-1130. A local attacker can exploit this vulnerability to perform arbitrary commands on the device without authentication. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc

Trust: 2.34

sources: NVD: CVE-2017-8416 // JVNDB: JVNDB-2017-014560 // CNVD: CNVD-2019-21249 // VULHUB: VHN-116619 // VULMON: CVE-2017-8416

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-21249

AFFECTED PRODUCTS

vendor:d linkmodel:dcs-1130scope: - version: -

Trust: 1.4

vendor:d linkmodel:dcs-1100scope: - version: -

Trust: 1.4

vendor:dlinkmodel:dcs-1130scope:eqversion: -

Trust: 1.0

vendor:dlinkmodel:dcs-1100scope:eqversion: -

Trust: 1.0

sources: CNVD: CNVD-2019-21249 // JVNDB: JVNDB-2017-014560 // NVD: CVE-2017-8416

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-8416
value: HIGH

Trust: 1.0

NVD: CVE-2017-8416
value: HIGH

Trust: 0.8

CNVD: CNVD-2019-21249
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201907-132
value: HIGH

Trust: 0.6

VULHUB: VHN-116619
value: HIGH

Trust: 0.1

VULMON: CVE-2017-8416
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-8416
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2019-21249
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-116619
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-8416
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2017-8416
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2019-21249 // VULHUB: VHN-116619 // VULMON: CVE-2017-8416 // JVNDB: JVNDB-2017-014560 // CNNVD: CNNVD-201907-132 // NVD: CVE-2017-8416

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-116619 // JVNDB: JVNDB-2017-014560 // NVD: CVE-2017-8416

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201907-132

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201907-132

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-014560

PATCH
title:Top Pageurl:https://www.dlink.com/en/consumer
Trust: 0.8
title:IoT_vulnerabilitiesurl:https://github.com/ethanhunnt/IoT_vulnerabilities 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-8416 // 
            
            
            
            JVNDB: JVNDB-2017-014560

EXTERNAL IDS
db:NVDid:CVE-2017-8416
Trust: 3.3
db:PACKETSTORMid:153226
Trust: 2.5
db:JVNDBid:JVNDB-2017-014560
Trust: 0.8
db:CNNVDid:CNNVD-201907-132
Trust: 0.7
db:CNVDid:CNVD-2019-21249
Trust: 0.6
db:VULHUBid:VHN-116619
Trust: 0.1
db:VULMONid:CVE-2017-8416
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-21249 // 
            
            
            
            VULHUB: VHN-116619 // 
            
            
            
            VULMON: CVE-2017-8416 // 
            
            
            
            JVNDB: JVNDB-2017-014560 // 
            
            
            
            PACKETSTORM: 153226 // 
            
            
            
            CNNVD: CNNVD-201907-132 // 
            
            
            
            NVD: CVE-2017-8416

REFERENCES
url:https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/dlink_dcs_1130_security.pdf
Trust: 3.2
url:http://packetstormsecurity.com/files/153226/dlink-dcs-1130-command-injection-csrf-stack-overflow.html
Trust: 3.0
url:https://seclists.org/bugtraq/2019/jun/8
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-8416
Trust: 1.5
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8416
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/ethanhunnt/iot_vulnerabilities
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8408
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8413
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8405
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8406
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8410
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8412
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8409
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8415
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8417
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8404
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8411
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8407
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8414
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-21249 // 
            
            
            
            VULHUB: VHN-116619 // 
            
            
            
            VULMON: CVE-2017-8416 // 
            
            
            
            JVNDB: JVNDB-2017-014560 // 
            
            
            
            PACKETSTORM: 153226 // 
            
            
            
            CNNVD: CNNVD-201907-132 // 
            
            
            
            NVD: CVE-2017-8416

CREDITS
Mandar Satam
Trust: 0.1
sources:
            
            
            PACKETSTORM: 153226

SOURCES
db:CNVDid:CNVD-2019-21249
db:VULHUBid:VHN-116619
db:VULMONid:CVE-2017-8416
db:JVNDBid:JVNDB-2017-014560
db:PACKETSTORMid:153226
db:CNNVDid:CNNVD-201907-132
db:NVDid:CVE-2017-8416

LAST UPDATE DATE
2024-11-23T21:37:05.022000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-21249date:2019-07-04T00:00:00
db:VULHUBid:VHN-116619date:2019-07-10T00:00:00
db:VULMONid:CVE-2017-8416date:2021-04-23T00:00:00
db:JVNDBid:JVNDB-2017-014560date:2019-07-11T00:00:00
db:CNNVDid:CNNVD-201907-132date:2021-04-25T00:00:00
db:NVDid:CVE-2017-8416date:2024-11-21T03:33:59.933

SOURCES RELEASE DATE
db:CNVDid:CNVD-2019-21249date:2019-07-04T00:00:00
db:VULHUBid:VHN-116619date:2019-07-02T00:00:00
db:VULMONid:CVE-2017-8416date:2019-07-02T00:00:00
db:JVNDBid:JVNDB-2017-014560date:2019-07-11T00:00:00
db:PACKETSTORMid:153226date:2019-06-07T15:06:02
db:CNNVDid:CNNVD-201907-132date:2019-07-02T00:00:00
db:NVDid:CVE-2017-8416date:2019-07-02T21:15:10.573