full-disclosure - [FD] [RCE] TP-Link Remote Code Execution CVE-2017-13772

Open Source and information security mailing list archives

Message-ID: <CACQ20qYurJcSsc4Qi+cd71H1rjSzqvj3UnLBQXw4DTKY=odmgg@mail.gmail.com>
Date: Thu, 19 Oct 2017 22:30:21 +0100
From: Kurtis Brown <kurtis@...tisebear.com>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [FD] [RCE] TP-Link Remote Code Execution CVE-2017-13772

** Advisory Information

Title: TP-Link Remote Code Execution
Blog URL: https://www.fidusinfosec.com/tp-link-remote-code-execution-cve-2017-13772/
Vendor: TP-Link
Date Published: 19/10/2017
CVE: CVE-2017-13772

** Vulnerability Summary

Numerous remote code execution paths were discovered in TP-Link's
WR940N home WiFi router. Valid credentials are required for this
attack path. It is possible for an authenticated attacker to obtain a
remote shell with root privileges.

** Details

There were multiple occurrences of strcpy being used in an unsafe
manner, resulting in a trivial buffer overflow condition. It is also
possible to cause a Denial of Service on the web service.

Using the ‘Diagnostic’ page, an attacker could utilise the built in
‘ping’ feature of the router to cause either; a Denial of Service
attack to crash the web server or exploit a buffer overflow condition
to obtain a remote root shell.

** Vendor Response

TP-Link have released a new version of the firmware thus mitigating
exploitation of this issue.

** Report Timeline

* Disclosed to vendor – 11/8/2017
* Response from vendor, request for initial advisory – 14/8/2017
* Initial advisory sent – 14/8/2017
* Beta patch sent for testing by vendor – 17/8/2017
* Patch confirmed to work, however other vulnerable locations were
identified, a second exploit was written to demonstrate this. Sent to
vendor – 17/8/2017
* Response by vendor, will look into the other vulnerable locations – 18/8/2017
* Second patch sent for testing by vendor – 25/8/17
* Patch confirmed to mitigate vulnerabilities (500+ calls to strcpy
removed) – 29/8/2017
* Patch released – 28/9/2017 (Only HW V5 US)

** Credit

This vulnerability was discovered by Tim Carrington, part of the Fidus
Information Security research team.

** References

https://www.fidusinfosec.com/tp-link-remote-code-execution-cve-2017-13772/

** Disclaimer

This advisory is licensed under a Creative Commons Attribution Non-Commercial
Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives