PT-2014-3097 · Asus · Asus Rt-N56U+1

Publicado 2014-01-22 · Atualizado 2016-12-31 · CVE-2013-6343

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374 979

Description The issue is related to multiple buffer overflows in the httpd web.c component. Remote attackers can execute arbitrary code by manipulating the apps name or apps flag parameters in the APP Installation.asp endpoint.

Recommendations For ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374 979, consider restricting access to the APP Installation.asp endpoint until a patch is available. As a temporary workaround, avoid using the apps name and apps flag parameters in the APP Installation.asp endpoint to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2013-6343

Produtos afetados

Asus Rt-Ac66U

Asus Rt-N56U

Referências · 7

• 🔥 http://infosec42.blogspot.com/2014/01/exploit-asus-rt-n56u-remote-root-shell.html · Exploit
• 🔥 http://exploit-db.com/exploits/31033 · Exploit
• 🔥 https://exploit-db.com/exploits/31033 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6343 · Nota de Segurança
• http://osvdb.org/102267 · Nota
• https://support.t-mobile.com/docs/DOC-21994 · Nota
• http://securityfocus.com/bid/65046 · Nota