CVE-2017-8412
Dlink DCS-1130 Command Injection / CSRF / Stack Overflow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that this binary dumps the HTTP VERB in the system logs. As a part of doing that it retrieves the HTTP VERB sent by the user and uses a vulnerable sprintf function at address 0x0000C3D4 in the function sub_C210 to copy the value into a string and then into a log file. Since there is no bounds check being performed on the environment variable at address 0x0000C360 this results in a stack overflow and overwrites the PC register allowing an attacker to execute buffer overflow or even a command injection attack.
Se detectó un problema en los dispositivos DCS-1100 y DCS-1130 de D-Link. El dispositivo presenta un binario personalizado llamado mp4ts en la carpeta /var/www/video. Al parecer este binario vuelca el VERB HTTP en los registros del sistema. Como parte de ello, recupera el VERB HTTP enviado por el usuario y usa una función sprintf vulnerable en la dirección 0x0000C3D4 en la función sub_C210 para copiar el valor en una cadena y luego en un archivo de registro. Dado que no se realiza ninguna comprobación de límites en la variable de entorno en la dirección 0x0000C360, esto resulta en un desbordamiento de pila y sobrescribe el registro PC, lo que permite a un atacante ejecutar un desbordamiento de búfer o incluso un ataque de inyección de comando.
Dlink DCS-1130 suffers from command injection, cross site request forgery, stack overflow, and various other vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-05-02 CVE Reserved
- 2019-06-07 CVE Published
- 2024-08-05 CVE Updated
- 2024-11-22 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html | Third Party Advisory |
|
| https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf | Not Applicable | |
| https://seclists.org/bugtraq/2019/Jun/8 | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Dlink Search vendor "Dlink" | Dcs-1130 Firmware Search vendor "Dlink" for product "Dcs-1130 Firmware" | - | - |
Affected
| in | Dlink Search vendor "Dlink" | Dcs-1130 Search vendor "Dlink" for product "Dcs-1130" | - | - |
Safe
|
| Dlink Search vendor "Dlink" | Dcs-1100 Firmware Search vendor "Dlink" for product "Dcs-1100 Firmware" | - | - |
Affected
| in | Dlink Search vendor "Dlink" | Dcs-1100 Search vendor "Dlink" for product "Dcs-1100" | - | - |
Safe
|