D-Link DIR-816 A2 1.10 B05 /goform/formLogin Long Password memory corruption

Summaryinfo

A vulnerability, which was classified as critical, was found in D-Link DIR-816 A2 1.10 B05. This issue affects some unknown processing of the file /goform/formLogin. Executing a manipulation as part of Long Password can lead to memory corruption. The identification of this vulnerability is CVE-2018-17067. The attack may be launched remotely. There is no exploit available. The application of restrictive firewalling is recommended.

Detailsinfo

A vulnerability classified as critical was found in D-Link DIR-816 A2 1.10 B05 (Router Operating System). This vulnerability affects some unknown functionality of the file /goform/formLogin. The manipulation as part of a Long Password leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. A very long password to /goform/formLogin could lead to a stack-based buffer overflow and overwrite the return address.

The bug was discovered 09/06/2018. The weakness was shared 09/15/2018 (Website). The advisory is shared for download at github.com. This vulnerability was named CVE-2018-17067 since 09/15/2018. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 03/24/2020).

The vulnerability was handled as a non-public zero-day exploit for at least 9 days. During that time the estimated underground price was around $5k-$25k.

Proper firewalling of is able to address this issue.

The entries VDB-124085, VDB-124083, VDB-124082 and VDB-124081 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-816 A2

Version

• 1.10 B05

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion