[NEWS] D-Link Router UPNP Stack Overflow



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



D-Link Router UPNP Stack Overflow
------------------------------------------------------------------------


SUMMARY

A remote stack overflow exists in a range of wired and wireless D-Link
routers. This vulnerability allows an attacker to execute privileged code
on an affected device. When a specific request is sent to an affected
device, a traditional stack overflow is triggered allowing an attacker
complete control of the router. With the ability to execute code on the
device, it is then possible to apply modified firmware, and ultimately
compromise the entire network.

The Universal Plug and Play (uPnP) stack on many D-Link devices is
vulnerable to a traditional remote stack overflow. This vulnerability
exists on the Local Area Network (LAN) interface of affected D-Link
devices. Due to the ease in which one can gain access to the LAN interface
of wireless devices, this attack is remote in nature.

DETAILS

Vulnerable Systems:
* DI-524 Rev A
* DI-524 Rev C
* DI-524 Rev D
* DI-604 Rev E
* DI-624 Rev C
* DI-624 Rev D
* DI-784 Rev A
* EBR-2310 Rev A
* WBR-1310 Rev A
* WBR-2310 Rev A

Technical Details:
The vulnerability exists within the M-SEARCH function. By issuing an
M-SEARCH request with an overly long parameter (approximately 800 bytes),
a stack overflow is triggered and an attacker can reliably execute code of
his/her choosing. This can be accomplished without affecting network
connectivity and without any signs of exploitation. In some exploitation
cases, the payload may require a soft-reset on the device, interrupting
connectivity for a brief moment.

The following request to UDP port 1900 will trigger the stack overflow:
M-SEARCH <800 byte string> HTTP/1.0

Information on exploiting vulnerabilities within embedded systems is
scarce. To successfully debug hardware devices you will generally require
external hardware for the debugging interface.

Vendor Status:
D-Link has released updates for all affected routers and they are
available for download from the D-Link website.


ADDITIONAL INFORMATION

The information has been provided by <mailto:Advisories@xxxxxxxx> eEye
Advisories.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [NEWS] D-Link DIR-100 Long URL Filter Evasion
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... D-Link DIR-100 Long URL Filter Evasion ... It is possible to exploit the vulnerability with a common web browser by ... We suggest the use of another device for filtering forbidden web resources ...
    (Securiteam)
  • [EXPL] Webcam Watchdog Stack Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Stack Overflow Vulnerability, a vulnerability in Webcam Watchdog allows ...
    (Securiteam)
  • [UNIX] Setterm Local Stack Overflow Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Setterm is "a utility that ships with many if not all UNIX and Linux ... The stack overflow condition exists because the -file command line ... copied into a buffer, the vulnerability manifests itself. ...
    (Securiteam)
  • [NEWS] D-Link DSA-3100 Cross-Site Scripting
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... D-Link DSA-3100 Cross-Site Scripting ... D-Link DSA-3100 Airspot Gateway is vulnerable to a security vulnerability ...
    (Securiteam)
  • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
    (Securiteam)