PT-2019-8633 · D Link · D-Link Dcs-1130+1

Mandar Satam · Published 2019-07-02 · Updated 2021-04-26 · CVE-2017-8410

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DCS-1100 (affected versions not specified) D-Link DCS-1130 (affected versions not specified)

Description An issue was discovered in the binary rtspd in the /sbin folder of the devices, which handles all rtsp connections. The binary performs a memcpy operation at address 0x00011E34 with the value sent in the "Authorization: Basic" RTSP header and stores it on the stack. The number of bytes to be copied is calculated based on the length of the string sent in the RTSP header by the client. As a result, memcpy copies more data than it can hold on the stack, corrupting the registers for the caller function sub F6CC, resulting in memory corruption. This allows for a buffer overflow, enabling control of the PC register and resulting in arbitrary code execution on the device.

Recommendations For D-Link DCS-1100, consider disabling the rtspd binary in the /sbin folder as a temporary workaround until a patch is available. For D-Link DCS-1130, consider disabling the rtspd binary in the /sbin folder as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-8410

Affected Products

D-Link Dcs-1100

D-Link Dcs-1130

References · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8410 · Security Note
• http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html · Note
• https://t.me/cibsecurity/5312 · Telegram Post
• https://t.me/cibsecurity/5422 · Telegram Post
• https://seclists.org/bugtraq/2019/Jun/8 · Note