Securifi Almond/Almond+/Almond 2015 AL-R096 MiniUPnP WscDevPutMessage NewInMessage input validation

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Securifi Almond, Almond+ and Almond 2015 AL-R096. The impacted element is the function WscDevPutMessage of the component MiniUPnP. This manipulation of the argument NewInMessage as part of SOAP Request causes input validation. This vulnerability is tracked as CVE-2017-8330. The attack is only possible within the local network. No exploit exists.

Detailsinfo

A vulnerability was found in Securifi Almond, Almond+ and Almond 2015 AL-R096. It has been declared as problematic. Affected by this vulnerability is the function WscDevPutMessage of the component MiniUPnP. The manipulation of the argument NewInMessage as part of a SOAP Request leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. The summary by CVE is:

An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a UPnP functionality for devices to interface with the router and interact with the device. It seems that the "NewInMessage" SOAP parameter passed with a huge payload results in crashing the process. If the firmware version AL-R096 is dissected using binwalk tool, we obtain a cpio-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "miniupnpd" is the one that has the vulnerable function that receives the values sent by the SOAP request. If we open this binary in IDA-pro we will notice that this follows a MIPS little endian format. The function WscDevPutMessage at address 0x0041DBB8 in IDA pro is identified to be receiving the values sent in the SOAP request. The SOAP parameter "NewInMesage" received at address 0x0041DC30 causes the miniupnpd process to finally crash when a second request is sent to the same process.

The weakness was disclosed 06/18/2019 as not defined mailinglist post (Bugtraq). It is possible to read the advisory at seclists.org. This vulnerability is known as CVE-2017-8330 since 04/29/2017. The exploitation appears to be easy. The attack can only be done within the local network. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-136204, VDB-136205, VDB-136206 and VDB-136207 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Securifi

Name

• Almond
• Almond+
• Almond 2015

Version

• AL-R096

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion