| शीर्षक | D-Link DIR-878 1.20B05 Heap-based Buffer Overflow |
|---|
| विवरण | A heap-based buffer overflow vulnerability was discovered in D-Link DIR-878 (REV A) firmware v1.20B05. The GetCAPTCHAsetting HNAP handler in bin/prog.cgi copies the attacker-controlled uid value from the HTTP Cookie header into an 11-byte heap allocation (malloc(0xb)) using strcpy, without any length check. The endpoint serves the login page and is reachable without authentication. Reproduction: curl -X POST /HNAP1/ with SOAPAction GetCAPTCHAsetting and Cookie uid=<512 bytes> returns HTTP 500 and crashes the FastCGI worker (SIGSEGV), while a short uid returns 200 OK; the crash threshold at ~11 bytes matches the malloc(0xb) size. An unauthenticated adjacent-network attacker can repeatedly crash the web management interface. The overflowed bytes are fully attacker-controlled, so heap metadata corruption and further code execution are plausible but were not developed. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering and dynamic differential testing. |
|---|
| स्रोत | ⚠️ https://github.com/Zimo-666/DIR-878-cves/tree/main/01-captcha-uid-heap-overflow |
|---|
| उपयोगकर्ता | ha ha-yang (UID 102151) |
|---|
| सबमिशन | 15/10/2026 09:44 AM (25 दिन पहले) |
|---|
| संयम | 08/11/2026 03:47 PM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 432892 [D-Link DIR-878 1.20B05 HNAP bin/prog.cgi GetCAPTCHAsetting uid बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|