D-Link DCS-1130 /sbin/rtspd String memory corruption

Summaryinfo

A vulnerability was found in D-Link DCS-1130. It has been declared as critical. This affects an unknown function of the file /sbin/rtspd. The manipulation as part of String results in memory corruption. This vulnerability was named CVE-2017-8410. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in D-Link DCS-1130 (version now known). Affected is some unknown processing of the file /sbin/rtspd. The manipulation as part of a String leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary performs a memcpy operation at address 0x00011E34 with the value sent in the "Authorization: Basic" RTSP header and stores it on the stack. The number of bytes to be copied are calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data then it can hold on stack and this results in corrupting the registers for the caller function sub_F6CC which results in memory corruption. The severity of this attack is enlarged by the fact that the same value is then copied on the stack in the function 0x00011378 and this allows to overflow the buffer allocated and thus control the PC register which will result in arbitrary code execution on the device.

The weakness was presented 07/02/2019 as not defined mailinglist post (Bugtraq). The advisory is available at seclists.org. This vulnerability is traded as CVE-2017-8410 since 05/02/2017. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 10/15/2023).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-136204, VDB-136205, VDB-136206 and VDB-136207 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• D-Link

Name

• DCS-1130

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion