ISE SOHO Vulnerability Catalog Published - Independent Security ...

Vulnerability: Multiple Buffer Overflow
CVE: CVE-2013-3100
CVE: CVE-2013-4659
Description
The TRENDnet TEW-812DRU router contains several software packages that are
susceptible to multiple Buffer Overflow attacks, and when triggered, can result in Denial
of Service or Remote Code Execution.
Vulnerable Software: KC_FTP, KC_SMB, RC Network Utility, and Broadcom ACSD.
Attack Requirements
♦ The attacker needs access to FTP, SMB, ACSD or HTTP network services in
order to launch the overflow attacks.
♦ Authentication is required to exploit the overflow present in the RC network
configuration binary accessible by the HTTP network service.
Details
♦ Other firmware versions were not tested and could be vulnerable.
♦ Vulnerable Commands (Not all commands were tested)
♦ KC_FTP: USER
♦ ACSD: autochannel&param, autochannel&data, csscan&ifname
♦ RC: wan_pptp_username, wan_pptp_password (From web application)
♦ KC_SMB: SMB Negotiation Request
Impact
♦ These vulnerabilities can lead to a denial-of-service or a total compromise of the
affected router.
Recommendations to the Vendor
♦ Perform bounds checking on user input that is copied into fixed length buffers.
♦ Avoid using functions such as strcpy() or sprintf() that don't perform bounds
checking.
♦ Additional information for vendors regarding immediate and long term fixes for
these issues can be found here: http://www.securityevaluators.com/content/casestudies/routers/#recommendationsVendors
Solution
♦ There currently is not a solution to this problem.
♦ Restrict access to WAN services to prevent an attacker from gaining access if an
15