PT-2016-3202 · D Link · Dap-2690+8

Dominic Chen · Publicado 2016-02-24 · Atualizado 2023-04-26 · CVE-2016-1558

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DAP-2310 versions 2.06 and earlier D-Link DAP-2330 versions 1.06 and earlier D-Link DAP-2360 versions 2.06 and earlier D-Link DAP-2553 H/W ver. B1 versions 3.05 and earlier D-Link DAP-2660 versions 1.11 and earlier D-Link DAP-2690 versions 3.15 and earlier D-Link DAP-2695 versions 1.16 and earlier D-Link DAP-3320 versions 1.00 and earlier D-Link DAP-3662 versions 1.01 and earlier

Description The issue is related to a buffer overflow in the D-Link router firmware, which can be exploited by a remote attacker using a specially crafted dlink uid cookie parameter. This may allow the attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For D-Link DAP-2310 versions 2.06 and earlier, update to a version later than 2.06. For D-Link DAP-2330 versions 1.06 and earlier, update to a version later than 1.06. For D-Link DAP-2360 versions 2.06 and earlier, update to a version later than 2.06. For D-Link DAP-2553 H/W ver. B1 versions 3.05 and earlier, update to a version later than 3.05. For D-Link DAP-2660 versions 1.11 and earlier, update to a version later than 1.11. For D-Link DAP-2690 versions 3.15 and earlier, update to a version later than 3.15. For D-Link DAP-2695 versions 1.16 and earlier, update to a version later than 1.16. For D-Link DAP-3320 versions 1.00 and earlier, update to a version later than 1.00. For D-Link DAP-3662 versions 1.01 and earlier, update to a version later than 1.01. As a temporary workaround, consider restricting access to the dlink uid cookie parameter until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2017-02482

CVE-2016-1558

Produtos afetados

Dap-2310

Dap-2330

Dap-2360

Dap-2553

Dap-2660

Dap-2690

Dap-2695

Dap-3320

Dap-3662

Referências · 6

• http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html · Nota
• http://dlink.com/mk/mk/support/support-news/2016/march/16/firmadyne-cve_2016_1558-cve_2016_1559 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1558 · Nota de Segurança
• http://seclists.org/fulldisclosure/2016/Feb/112 · Nota
• https://osv.dev/vulnerability/CVE-2016-1558 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02482 · Nota de Segurança