cnvd - cnvd-2018-05801

cnvd-2018-05801

Vulnerability from cnvd

Title: MikroTik RouterOS缓冲区溢出漏洞

Description:

MikroTik RouterOS是MikroTik公司基于Linux内核开发的一种路由操作系统，通过安装该系统可将标准的x86 PC设备变成专业路由器。

MikroTik RouterOS 6.41.3及之前版本存在缓冲区溢出漏洞。该漏洞源于MikroTik RouterOS在处理NetBIOS会话请求时，它的SMB服务中会出现缓冲区溢出问题。由于溢出问题发生在身份验证之前，因此未经身份验证的远程攻击者可以利用此漏洞获取该系统的代码执行权限。

Severity: 高

Patch Name: MikroTik RouterOS缓冲区溢出漏洞的补丁

Patch Description:

MikroTik RouterOS是MikroTik公司基于Linux内核开发的一种路由操作系统，通过安装该系统可将标准的x86 PC设备变成专业路由器。

MikroTik RouterOS 6.41.3及之前版本存在缓冲区溢出漏洞。该漏洞源于MikroTik RouterOS在处理NetBIOS会话请求时，它的SMB服务中会出现缓冲区溢出问题。由于溢出问题发生在身份验证之前，因此未经身份验证的远程攻击者可以利用此漏洞获取该系统的代码执行权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布漏洞修复程序，请及时关注更新： https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow

Reference: https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow

Impacted products

Name
MikroTik RouterOS <=6.41.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-7445"
    }
  },
  "description": "MikroTik RouterOS\u662fMikroTik\u516c\u53f8\u57fa\u4e8eLinux\u5185\u6838\u5f00\u53d1\u7684\u4e00\u79cd\u8def\u7531\u64cd\u4f5c\u7cfb\u7edf\uff0c\u901a\u8fc7\u5b89\u88c5\u8be5\u7cfb\u7edf\u53ef\u5c06\u6807\u51c6\u7684x86 PC\u8bbe\u5907\u53d8\u6210\u4e13\u4e1a\u8def\u7531\u5668\u3002\r\n\r\nMikroTik RouterOS 6.41.3\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eMikroTik RouterOS\u5728\u5904\u7406NetBIOS\u4f1a\u8bdd\u8bf7\u6c42\u65f6\uff0c\u5b83\u7684SMB\u670d\u52a1\u4e2d\u4f1a\u51fa\u73b0\u7f13\u51b2\u533a\u6ea2\u51fa\u95ee\u9898\u3002\u7531\u4e8e\u6ea2\u51fa\u95ee\u9898\u53d1\u751f\u5728\u8eab\u4efd\u9a8c\u8bc1\u4e4b\u524d\uff0c\u56e0\u6b64\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u8be5\u7cfb\u7edf\u7684\u4ee3\u7801\u6267\u884c\u6743\u9650\u3002",
  "discovererName": "Juan Caillava and Maximiliano Vidal",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-05801",
  "openTime": "2018-03-20",
  "patchDescription": "MikroTik RouterOS\u662fMikroTik\u516c\u53f8\u57fa\u4e8eLinux\u5185\u6838\u5f00\u53d1\u7684\u4e00\u79cd\u8def\u7531\u64cd\u4f5c\u7cfb\u7edf\uff0c\u901a\u8fc7\u5b89\u88c5\u8be5\u7cfb\u7edf\u53ef\u5c06\u6807\u51c6\u7684x86 PC\u8bbe\u5907\u53d8\u6210\u4e13\u4e1a\u8def\u7531\u5668\u3002\r\n\r\nMikroTik RouterOS 6.41.3\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eMikroTik RouterOS\u5728\u5904\u7406NetBIOS\u4f1a\u8bdd\u8bf7\u6c42\u65f6\uff0c\u5b83\u7684SMB\u670d\u52a1\u4e2d\u4f1a\u51fa\u73b0\u7f13\u51b2\u533a\u6ea2\u51fa\u95ee\u9898\u3002\u7531\u4e8e\u6ea2\u51fa\u95ee\u9898\u53d1\u751f\u5728\u8eab\u4efd\u9a8c\u8bc1\u4e4b\u524d\uff0c\u56e0\u6b64\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u8be5\u7cfb\u7edf\u7684\u4ee3\u7801\u6267\u884c\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "MikroTik RouterOS\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "MikroTik RouterOS \u003c=6.41.3"
  },
  "referenceLink": "https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow",
  "serverity": "\u9ad8",
  "submitTime": "2018-03-20",
  "title": "MikroTik RouterOS\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2018-7445 (GCVE-0-2018-7445)

Vulnerability from cvelistv5

Published

2018-03-19 21:00

Modified

2025-07-30 01:46

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Summary

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/103427	vdb-entry, x_refsource_BID
	http://seclists.org/fulldisclosure/2018/Mar/38	mailing-list, x_refsource_FULLDISC
	https://www.exploit-db.com/exploits/44290/	exploit, x_refsource_EXPLOIT-DB
	https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:24:11.978Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "103427",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103427"
          },
          {
            "name": "20180315 [CORE-2018-0003] MikroTik RouterOS SMB Buffer Overflow",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2018/Mar/38"
          },
          {
            "name": "44290",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44290/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2018-7445",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-07T16:27:32.357265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-09-08",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7445"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:46:18.809Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2022-09-08T00:00:00+00:00",
            "value": "CVE-2018-7445 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-03-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-20T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "103427",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103427"
        },
        {
          "name": "20180315 [CORE-2018-0003] MikroTik RouterOS SMB Buffer Overflow",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2018/Mar/38"
        },
        {
          "name": "44290",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44290/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-7445",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "103427",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103427"
            },
            {
              "name": "20180315 [CORE-2018-0003] MikroTik RouterOS SMB Buffer Overflow",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2018/Mar/38"
            },
            {
              "name": "44290",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44290/"
            },
            {
              "name": "https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow",
              "refsource": "MISC",
              "url": "https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-7445",
    "datePublished": "2018-03-19T21:00:00.000Z",
    "dateReserved": "2018-02-23T00:00:00.000Z",
    "dateUpdated": "2025-07-30T01:46:18.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted