| 标题 | D-Link DIR-513 1.10 Buffer Overflow |
|---|
| 描述 | Stack-based Buffer Overflow in D-Link DIR-513 formSetDDNS function Description: D-Link DIR-513 devices (A1 FW110, A2 FW110) contain a stack-based buffer overflow vulnerability in the formSetDDNS function of the web management interface (at offset 0x466fdc). The vulnerability arises when the application processes the curTime parameter from an HTTP POST request. The program retrieves this user-controlled value via websGetVar and passes it to an unsafe sprintf call at address 0x467720 to format a string into a fixed-size 128-byte stack buffer (v31).
Due to the lack of boundary checks, an attacker can provide a specially crafted curTime value exceeding the buffer capacity to overwrite the return address on the stack (located 160 bytes away from the buffer start). This can lead to a Denial of Service (DoS) or arbitrary Remote Code Execution (RCE) with elevated privileges. Additionally, a secondary risk exists at address 0x4676e4, where a strcpy operation can further propagate the overflow into the err_msg global buffer. |
|---|
| 来源 | ⚠️ https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formSetDDNS |
|---|
| 用户 | AttackingLin (UID 88138) |
|---|
| 提交 | 2026-03-06 04時56分 (7 月前) |
|---|
| 管理 | 2026-03-20 09時27分 (14 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 349229 [D-Link DIR-513 1.10 /goform/formSetDDNS curTime 内存损坏] |
|---|
| 积分 | 0 |
|---|