Securifi Almond/Almond+/Almond 2015 AL-R096 Route goahead sub_00420F38 POST Parameter memory corruption

Summaryinfo

A vulnerability was found in Securifi Almond, Almond+ and Almond 2015 AL-R096. It has been rated as critical. This affects the function sub_00420F38 of the file goahead of the component Route Handler. This manipulation as part of POST Parameter causes memory corruption. This vulnerability appears as CVE-2017-8336. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability has been found in Securifi Almond, Almond+ and Almond 2015 AL-R096 and classified as critical. Affected by this vulnerability is the function sub_00420F38 of the file goahead of the component Route Handler. The manipulation as part of a POST Parameter leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding new routes to the device. It seems that the POST parameters passed in this request to set up routes on the device can be set in such a way that would result in overflowing the stack set up and allow an attacker to control the $ra register stored on the stack. If the firmware version AL-R096 is dissected using binwalk tool, we obtain a cpio-root archive which contains the filesystem set up on the device that contains all the binaries. The binary "goahead" is the one that has the vulnerable function that recieves the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows a MIPS little endian format. The function sub_00420F38 in IDA pro is identified to be receiving the values sent in the POST request. The POST parameter "gateway" allows to overflow the stack and control the $ra register after 1546 characters. The value from this post parameter is then copied on the stack at address 0x00421348 as shown below. This allows an attacker to provide the payload of his/her choice and finally take control of the device.

The weakness was presented 06/18/2019 as not defined mailinglist post (Bugtraq). The advisory is shared at seclists.org. This vulnerability is known as CVE-2017-8336 since 04/29/2017. The attack can be launched remotely. The successful exploitation requires a single authentication. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-136204, VDB-136205, VDB-136206 and VDB-136207 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Securifi

Name

• Almond
• Almond+
• Almond 2015

Version

• AL-R096

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion