| 标题 | D-Link DIR-868L B1 Stack-based Buffer Overflow |
|---|
| 描述 | An unauthenticated stack-based buffer overflow exists in the cgibin binary of D-Link DIR-868L (hardware revision B1) firmware v2.01b05 (DIR868LB1_FW201b05.bin, component SHA-256: d09c8d79cbe2e896e78a82adfcc3fab15f804a8ee551524fe148223071392a55).
CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
The authentication handler (file offset 0x14760, dispatched for authentication.cgi, authentication_logout.cgi, webfa_authentication.cgi, webfa_authentication_logout.cgi, and the SharePort WAN-side alias /dws/api/Login on port 8181) copies the URL query parameters "id" and "password" into fixed 0x400-byte stack buffers using strcpy() at function entry, before any authentication or input validation. The query-string parser imposes no length limit on parameter values.
A single unauthenticated HTTP GET request with an oversized "id" value overwrites the saved return address at offset 0x744 (password: 0xB44). No stack canary, executable stack (PT_GNU_STACK=RWX). Verified arbitrary command execution as root (Uid:0, CapEff:ffffffffffffffff) with a single request, independent of kernel ASLR modes 0/1.
Distinct from CVE-2016-5681 (VU#332115): that flaw overflows the session-cookie uid value in the cookie-validation function; this flaw overflows via id/password URL query parameters at the authentication dispatcher's entry copies (different taint source, vulnerable function, and overwrite offsets).
Full advisory and crash PoC: https://github.com/Walnut1337/CVE
Related (differentiated): https://www.kb.cert.org/vuls/id/332115 |
|---|
| 来源 | ⚠️ https://github.com/Walnut1337/CVE/blob/main/poc/poc_crash.py |
|---|
| 用户 | Walnut1337 (UID 100856) |
|---|
| 提交 | 2026-08-28 15時27分 (24 日前) |
|---|
| 管理 | 2026-09-20 10時02分 (23 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 408017 [D-Link DIR-868L 2.01b05 Authentication webfa_authentication.cgi strcpy id/password 内存损坏] |
|---|
| 积分 | 20 |
|---|