D-Link DCS-1100/DCS-1130 Service Port 5978 strcpy memory corruption

Summaryinfo

A vulnerability described as critical has been identified in D-Link DCS-1100 and DCS-1130. This vulnerability affects the function strcpy of the component Service Port 5978. The manipulation results in memory corruption. This vulnerability is cataloged as CVE-2017-8416. The attack must originate from the local network. There is no exploit available.

Detailsinfo

A vulnerability was found in D-Link DCS-1100 and DCS-1130 (unknown version). It has been classified as critical. Affected is the function strcpy of the component Service Port 5978. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for broadcast packets sent on 255.255.255.255. This daemon handles custom D-Link UDP based protocol that allows D-Link mobile applications and desktop applications to discover D-Link devices on the local network. The binary processes the received UDP packets sent from any device in "main" function. One path in the function traverses towards a block of code that processing of packets which does an unbounded copy operation which allows to overflow the buffer. The custom protocol created by Dlink follows the following pattern: Packetlen, Type of packet; M=MAC address of device or broadcast; D=Device Type;C=base64 encoded command string;test=1111 We can see at address function starting at address 0x0000DBF8 handles the entire UDP packet and performs an insecure copy using strcpy function at address 0x0000DC88. This results in overflowing the stack pointer after 1060 characters and thus allows to control the PC register and results in code execution. The same form of communication can be initiated by any process including an attacker process on the mobile phone or the desktop and this allows a third-party application on the device to execute commands on the device without any authentication by sending just 1 UDP packet with custom base64 encoding.

The weakness was shared 07/02/2019 as not defined mailinglist post (Bugtraq). The advisory is shared for download at seclists.org. This vulnerability is traded as CVE-2017-8416 since 05/02/2017. Access to the local network is required for this attack. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 10/15/2023).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-136204, VDB-136205, VDB-136206 and VDB-136207 are related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• D-Link

Name

• DCS-1100
• DCS-1130

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion