Asus RT-N300 SSDP Response XML Document memory corruption

Summaryinfo

A vulnerability, which was classified as critical, has been found in Asus RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16 and RT-N300. This issue affects some unknown processing of the component SSDP Response Handler. This manipulation as part of XML Document causes memory corruption. This vulnerability is tracked as CVE-2017-11344. The attack is only possible within the local network. No exploit exists.

Detailsinfo

A vulnerability has been found in Asus RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16 and RT-N300 and classified as critical. Affected by this vulnerability is an unknown functionality of the component SSDP Response Handler. The manipulation as part of a XML Document leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Global buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC3200, RT-AC3100, RT_AC1200GU, RT_AC1200G, RT-AC1200, RT-AC53, RT-N12HP, RT-N12HP_B1, RT-N12D1, RT-N12+, RT_N12+_PRO, RT-N16, and RT-N300 devices allows remote attackers to write shellcode at any address in the heap; this can be used to execute arbitrary code on the router by hosting a crafted device description XML document at a URL specified within a Location header in an SSDP response.

The bug was discovered 07/14/2017. The weakness was disclosed 07/17/2017 (Website). The advisory is shared at openwall.com. This vulnerability is known as CVE-2017-11344 since 07/16/2017. The attack can only be done within the local network. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-97734, VDB-97735, VDB-103658 and VDB-103744 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Asus

Name

• RT-AC51U
• RT-AC52U
• RT-AC53
• RT-AC55U
• RT-AC56U
• RT-AC58U
• RT-AC66U
• RT-AC66U_B1
• RT-AC68P
• RT-AC88U
• RT-AC1200
• RT-AC3100
• RT-AC3200
• RT-N12+
• RT-N12D1
• RT-N12HP
• RT-N12HP_B1
• RT-N16
• RT-N18U
• RT-N56U
• RT-N66U
• RT-N300
• RT_AC1200G
• RT_AC1200GU
• RT_N12+_PRO

License

• commercial

Website

• Vendor: https://www.asus.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion