Re: Three vulnerabilities found in MikroTik's RouterOS

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->
<a href="/fulldisclosure/"><img src="/images/fulldisclosure-logo.png" class="l-logo right" alt="fulldisclosure logo" width="80"></a>
<h2 class="m-list"><a href="/fulldisclosure/">Full Disclosure</a>
mailing list archives</h2>
<!--X-User-Header-End-->
<!--X-TopPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="7"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#10">By Date</a>
<a href="11"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="7"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#10">By Thread</a>
<a href="21"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<form class="nst-search center" action="/search/fulldisclosure">
<input class="nst-search-q" name="q" type="search" placeholder="List Archive Search">
<button class="nst-search-button" title="Search">
<img style="width:100%;aspect-ratio:1/1;" alt="" aria-hidden="true" src="/shared/images/nst-icons.svg#search">
</button>
</form>

</div>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
<h1 class="m-title">Re: Three vulnerabilities found in MikroTik's RouterOS</h1>
<hr>
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->


<em>From</em>: Q C &lt;cq674350529 () gmail com&gt;


<em>Date</em>: Tue, 4 May 2021 16:44:53 +0800


<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<hr>
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
<pre style="margin: 0em;">[update 2021/05/04] Three CVEs have been assigned to these vulnerabilities.

CVE-2020-20215: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a
memory corruption vulnerability in the /nova/bin/diskd process. An
authenticated remote attacker can cause a Denial of Service due to invalid
memory access.

CVE-2020-20216: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a
memory corruption vulnerability in the /nova/bin/graphing process. An
authenticated remote attacker can cause a Denial of Service (NULL pointer
dereference)

CVE-2020-20213: Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an
stack exhaustion vulnerability in the /nova/bin/net process. An
authenticated remote attacker can cause a Denial of Service due to
overloading the systems CPU



Q C &lt;cq674350529 () gmail com&gt; 于2020年7月22日周三 下午8:11写道：

</pre><blockquote style="border-left: #5555EE solid 0.2em; margin: 0em; padding-left: 0.85em"><pre style="margin: 0em;">Advisory: three vulnerabilities found in MikroTik's RouterOS


Details
=======

Product: MikroTik's RouterOS
Vendor URL: <a rel="nofollow" href="https://mikrotik.com/">https://mikrotik.com/</a>
Vendor Status: fixed version released
CVE: -
Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team


Product Description
==================

RouterOS is the operating system used on the MikroTik's devices, such as
switch, router and access point.


Description of vulnerabilities
==========================

1. Memory corruption vulnerability
The diskd process suffers from a memory corruption vulnerability. By
sending a crafted packet, an authenticated remote user can crash the diskd
process due to invalid memory access.

Against stable 6.44.3, the poc resulted in the following crash dump.

    # cat /rw/logs/backtrace.log
    2020.06.04-14:18:22.55@0:
    2020.06.04-14:18:22.55@0:
    2020.06.04-14:18:22.55@0: /nova/bin/diskd
    2020.06.04-14:18:22.55@0: --- signal=11
--------------------------------------------
    2020.06.04-14:18:22.55@0:
    2020.06.04-14:18:22.55@0: eip=0x776cd1db eflags=0x00010202
    2020.06.04-14:18:22.55@0: edi=0x08056760 esi=0x08056790
ebp=0x7fd40b78 esp=0x7fd40b6c
    2020.06.04-14:18:22.55@0: eax=0x0000001b ebx=0x776d54ec
ecx=0x776d54ec edx=0x20fe0010
    2020.06.04-14:18:22.55@0:
    2020.06.04-14:18:22.55@0: maps:
    2020.06.04-14:18:22.55@0: 08048000-08052000 r-xp 00000000 00:0c 1131
      /nova/bin/diskd
    2020.06.04-14:18:22.55@0: 77672000-776a7000 r-xp 00000000 00:0c 996
     /lib/libuClibc-0.9.33.2.so
    2020.06.04-14:18:22.55@0: 776ab000-776c5000 r-xp 00000000 00:0c 992
     /lib/libgcc_s.so.1
    2020.06.04-14:18:22.55@0: 776c6000-776d5000 r-xp 00000000 00:0c 976
     /lib/libuc++.so
    2020.06.04-14:18:22.55@0: 776d6000-776de000 r-xp 00000000 00:0c 982
     /lib/libubox.so
    2020.06.04-14:18:22.55@0: 776df000-7772b000 r-xp 00000000 00:0c 978
     /lib/libumsg.so
    2020.06.04-14:18:22.55@0: 77731000-77738000 r-xp 00000000 00:0c 990
     /lib/ld-uClibc-0.9.33.2.so
    2020.06.04-14:18:22.55@0:
    2020.06.04-14:18:22.55@0: stack: 0x7fd41000 - 0x7fd40b6c
    2020.06.04-14:18:22.55@0: ec 54 6d 77 1b 00 00 00 88 67 05 08 98 0b
d4 7f c6 c6 04 08 88 67 05 08 1b 00 00 00 10 00 fe 20
    2020.06.04-14:18:22.55@0: 10 00 fe 20 ec 54 6d 77 f0 ea 6d 77 08 0c
d4 7f 6d a9 6d 77 88 67 05 08 1b 00 00 00 05 00 00 00
    2020.06.04-14:18:22.55@0:
    2020.06.04-14:18:22.55@0: code: 0x776cd1db
    2020.06.04-14:18:22.55@0: 8b 00 8b 10 01 c2 83 c2 04 52 83 c0 04 50
ff 75

This vulnerability was initially found in long-term 6.44.5, and has been
fixed in stable 6.47.

2. NULL pointer dereference vulnerability
The graphing process suffers from a memory corruption vulnerability. By
sending a crafted packet, an authenticated remote user can crash the
graphing process due to NULL
pointer dereference.

Against stable 6.46.5, the poc resulted in the following crash dump.

    # cat /rw/logs/backtrace.log
    2020.06.04-15:12:41.47@0:
    2020.06.04-15:12:41.47@0:
    2020.06.04-15:12:41.47@0: /nova/bin/graphing
    2020.06.04-15:12:41.47@0: --- signal=11
--------------------------------------------
    2020.06.04-15:12:41.47@0:
    2020.06.04-15:12:41.47@0: eip=0x080521e2 eflags=0x00010202
    2020.06.04-15:12:41.47@0: edi=0x080610a0 esi=0x08061cb8
ebp=0x7fa8acd8 esp=0x7fa8acb0
    2020.06.04-15:12:41.47@0: eax=0x08061db8 ebx=0x7fa8ad0c
ecx=0x00000000 edx=0x08061ce8
    2020.06.04-15:12:41.47@0:
    2020.06.04-15:12:41.47@0: maps:
    2020.06.04-15:12:41.47@0: 08048000-0805c000 r-xp 00000000 00:0c 1038
      /nova/bin/graphing
    2020.06.04-15:12:41.47@0: 77651000-77686000 r-xp 00000000 00:0c 964
     /lib/libuClibc-0.9.33.2.so
    2020.06.04-15:12:41.47@0: 7768a000-776a4000 r-xp 00000000 00:0c 960
     /lib/libgcc_s.so.1
    2020.06.04-15:12:41.47@0: 776a5000-776b4000 r-xp 00000000 00:0c 944
     /lib/libuc++.so
    2020.06.04-15:12:41.47@0: 776b5000-776bd000 r-xp 00000000 00:0c 950
     /lib/libubox.so
    2020.06.04-15:12:41.47@0: 776be000-7770a000 r-xp 00000000 00:0c 946
     /lib/libumsg.so
    2020.06.04-15:12:41.47@0: 7770d000-77717000 r-xp 00000000 00:0c 961
     /lib/libm-0.9.33.2.so
    2020.06.04-15:12:41.47@0: 7771c000-77723000 r-xp 00000000 00:0c 958
     /lib/ld-uClibc-0.9.33.2.so
    2020.06.04-15:12:41.47@0:
    2020.06.04-15:12:41.47@0: stack: 0x7fa8b000 - 0x7fa8acb0
    2020.06.04-15:12:41.47@0: e8 1c 06 08 b8 1d 06 08 00 00 00 00 01 00
00 00 0c ad a8 7f 5b 00 00 00 b8 98 05 08 b8 98 05 08
    2020.06.04-15:12:41.47@0: f0 da 6b 77 0c ad a8 7f 28 ad a8 7f 3a bc
6b 77 b8 1c 06 08 0c ad a8 7f 05 00 00 00 a0 10 06 08
    2020.06.04-15:12:41.47@0:
    2020.06.04-15:12:41.47@0: code: 0x80521e2
    2020.06.04-15:12:41.47@0: ff 51 04 83 c4 18 6a 5c 53 e8 a0 9c ff ff
8b 56

This vulnerability was initially found in long-term 6.44.6, and has been
fixed in stable 6.47.

3. Stack exhaustion vulnerability
The net process suffers from a stack exhaustion vulnerability. By sending
a crafted packet to the net process, an authenticated remote user can
trigger a stack exhaustion vulnerability via recursive function calls.

When testing the proof of concept on an x86 RouterOS VM, this
vulnerability didn't just crash net process but caused the whole system to
reboot.

Against stable 6.46.5, the poc resulted in the following crash dump.

    # cat /rw/logs/backtrace.log
    2020.06.08-11:19:45.40@0:
    2020.06.08-11:19:45.40@0:
    2020.06.08-11:19:45.40@0: /nova/bin/net
    2020.06.08-11:19:45.40@0: --- signal=11
--------------------------------------------
    2020.06.08-11:19:45.40@0:
    2020.06.08-11:19:45.40@0: eip=0x0809ec65 eflags=0x00010206
    2020.06.08-11:19:45.40@0: edi=0x7fb0fe4c esi=0x7fb0ff48
ebp=0x7f311018 esp=0x7f310fe0
    2020.06.08-11:19:45.40@0: eax=0x00fe0008 ebx=0x7772cae4
ecx=0x7772cae4 edx=0x08122630
    2020.06.08-11:19:45.40@0:
    2020.06.08-11:19:45.40@0: maps:
    2020.06.08-11:19:45.40@0: 08048000-08121000 r-xp 00000000 00:0c 1004
      /nova/bin/net
    2020.06.08-11:19:45.40@0: 77654000-77689000 r-xp 00000000 00:0c 964
     /lib/libuClibc-0.9.33.2.so
    2020.06.08-11:19:45.40@0: 7768d000-776a7000 r-xp 00000000 00:0c 960
     /lib/libgcc_s.so.1
    2020.06.08-11:19:45.40@0: 776a8000-776b7000 r-xp 00000000 00:0c 944
     /lib/libuc++.so
    2020.06.08-11:19:45.40@0: 776b8000-776c6000 r-xp 00000000 00:0c 945
     /lib/libz.so
    2020.06.08-11:19:45.40@0: 776c7000-776d1000 r-xp 00000000 00:0c 961
     /lib/libm-0.9.33.2.so
    2020.06.08-11:19:45.40@0: 776d3000-776db000 r-xp 00000000 00:0c 950
     /lib/libubox.so
    2020.06.08-11:19:45.40@0: 776dc000-776df000 r-xp 00000000 00:0c 948
     /lib/libuxml++.so
    2020.06.08-11:19:45.40@0: 776e0000-7772c000 r-xp 00000000 00:0c 946
     /lib/libumsg.so
    2020.06.08-11:19:45.40@0: 7772f000-7774c000 r-xp 00000000 00:0c 947
     /lib/libucrypto.so
    2020.06.08-11:19:45.40@0: 77750000-77757000 r-xp 00000000 00:0c 958
     /lib/ld-uClibc-0.9.33.2.so
    2020.06.08-11:19:45.40@0:
    2020.06.08-11:19:45.40@0: stack: 0x7fb10000 - 0x7f310fe0

This vulnerability was initially found in long-term 6.44.5, and has been
fixed in stable 6.47.


Solution
========

Upgrade to the corresponding latest RouterOS tree version.


References
==========

[1] <a rel="nofollow" href="https://mikrotik.com/download/changelogs/stable-release-tree">https://mikrotik.com/download/changelogs/stable-release-tree</a>


</pre></blockquote><pre style="margin: 0em;">
_______________________________________________
Sent through the Full Disclosure mailing list
<a rel="nofollow" href="https://nmap.org/mailman/listinfo/fulldisclosure">https://nmap.org/mailman/listinfo/fulldisclosure</a>
Web Archives &amp; RSS: <a rel="nofollow" href="http://seclists.org/fulldisclosure/">http://seclists.org/fulldisclosure/</a></pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="7"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#10">By Date</a>
<a href="11"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="7"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#10">By Thread</a>
<a href="21"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
</div>
<h3 class="m-thread">Current thread:</h3>
<ul class="thread">
<li><strong>Re: Three vulnerabilities found in MikroTik's RouterOS</strong> <em>Q C (May 07)</em>
<ul>
<li><a name="21" href="21">Re: Three vulnerabilities found in MikroTik's RouterOS</a> <em>Gynvael Coldwind (May 11)</em>
<ul>
<li><a name="22" href="22">Re: Three vulnerabilities found in MikroTik's RouterOS</a> <em>Q C (May 11)</em>
<ul>
<li><a name="24" href="24">Re: Three vulnerabilities found in MikroTik's RouterOS</a> <em>Gynvael Coldwind (May 11)</em>
</li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li>&lt;Possible follow-ups&gt;</li>
<li><a name="11" href="11">Re: Three vulnerabilities found in MikroTik's RouterOS</a> <em>Q C (May 07)</em>
</li>
 </ul>
</li>
</ul>


<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
<p>