Mikrotik RouterOS NULL Pointer Dereference / Reachable Assertion Failure ≈ Packet Storm – Digitalmunition




Exploit/Advisories no-image-featured-image.png

Published on August 15th, 2020 📆 | 3374 Views ⚑

0

Mikrotik RouterOS NULL Pointer Dereference / Reachable Assertion Failure ≈ Packet Storm

Advisory: two vulnerabilities found in MikroTik’s RouterOS

Details
=======

Product: MikroTik’s RouterOS
Vendor URL: https://mikrotik.com/
Vendor Status: fixed version released
CVE: –
Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team

Product Description
==================

RouterOS is the operating system used on the MikroTik’s devices, such as
switch, router and access point.

Description of vulnerabilities
==========================

1. NULL pointer dereference
The igmpproxy process suffers from a memory corruption vulnerability. By
sending a crafted packet, an authenticated remote user can crash the
igmpproxy process due to NULL pointer dereference.

Against stable 6.46.5, the poc resulted in the following crash dump.

# cat /rw/logs/backtrace.log
2020.06.04-17:44:[email protected]:
2020.06.04-17:44:[email protected]:
2020.06.04-17:44:[email protected]: /ram/pckg/multicast/nova/bin/igmpproxy
2020.06.04-17:44:[email protected]: — signal=11
——————————————–
2020.06.04-17:44:[email protected]:
2020.06.04-17:44:[email protected]: eip=0x08050a8d eflags=0x00010206
2020.06.04-17:44:[email protected]: edi=0x7fa9331c esi=0x7fa932b8 ebp=0x7fa932a8
esp=0x7fa9326c
2020.06.04-17:44:[email protected]: eax=0x080581bc ebx=0x00000000 ecx=0x0000000b
edx=0x00000000
2020.06.04-17:44:[email protected]:
2020.06.04-17:44:[email protected]: maps:
2020.06.04-17:44:[email protected]: 08048000-08053000 r-xp 00000000 00:13 16
/ram/pckg/multicast/nova/bin/igmpproxy
2020.06.04-17:44:[email protected]: 7770b000-77740000 r-xp 00000000 00:0c 964
/lib/libuClibc-0.9.33.2.so
2020.06.04-17:44:[email protected]: 77744000-7775e000 r-xp 00000000 00:0c 960
/lib/libgcc_s.so.1
2020.06.04-17:44:[email protected]: 7775f000-7776e000 r-xp 00000000 00:0c 944
/lib/libuc++.so
2020.06.04-17:44:[email protected]: 7776f000-77777000 r-xp 00000000 00:0c 950
/lib/libubox.so
2020.06.04-17:44:[email protected]: 77778000-777c4000 r-xp 00000000 00:0c 946
/lib/libumsg.so
2020.06.04-17:44:[email protected]: 777ca000-777d1000 r-xp 00000000 00:0c 958
/lib/ld-uClibc-0.9.33.2.so
2020.06.04-17:44:[email protected]:
2020.06.04-17:44:[email protected]: stack: 0x7fa94000 – 0x7fa9326c
2020.06.04-17:44:[email protected]: 01 00 00 00 e8 7f 05 08 10 00 00 00 98 32 a9
7f 11 00 00 00 78 57 05 08 14 33 a9 7f a8 32 a9 7f
2020.06.04-17:44:[email protected]: 67 29 79 77 04 5d 05 08 6c 25 79 77 d8 32 a9
7f e0 57 05 08 b8 32 a9 7f 1c 33 a9 7f d8 32 a9 7f
2020.06.04-17:44:[email protected]:
2020.06.04-17:44:[email protected]: code: 0x8050a8d
2020.06.04-17:44:[email protected]: 8b 03 ff 30 6a 01 56 e8 77 a8 ff ff 83 c4 0c
0f

This vulnerability was initially found in long-term 6.44.6, and was fixed
in stable 6.47.

2. reachable assertion failure
The ipsec process suffers from an assertion failure vulnerability. There is
a reachable assertion in the ipsec process. By sending a crafted packet, an
authenticated remote user can crash the ipsec process due to assertion
failure.

Against stable 6.46.5, the poc resulted in the following crash dump.

# cat /rw/logs/backtrace.log
2020.06.04-18:25:[email protected]:
2020.06.04-18:25:[email protected]:
2020.06.04-18:25:[email protected]: /ram/pckg/security/nova/bin/ipsec
2020.06.04-18:25:[email protected]: — signal=6
——————————————–
2020.06.04-18:25:[email protected]:
2020.06.04-18:25:[email protected]: eip=0x7748155b eflags=0x00000246
2020.06.04-18:25:[email protected]: edi=0x00000001 esi=0x77489200 ebp=0x7f8fa450
esp=0x7f8fa448
2020.06.04-18:25:[email protected]: eax=0x00000000 ebx=0x00000291 ecx=0x00000291
edx=0x00000006
2020.06.04-18:25:[email protected]:
2020.06.04-18:25:[email protected]: maps:
2020.06.04-18:25:[email protected]: 08048000-080b5000 r-xp 00000000 00:11 42
/ram/pckg/security/nova/bin/ipsec
2020.06.04-18:25:[email protected]: 77453000-77488000 r-xp 00000000 00:0c 964
/lib/libuClibc-0.9.33.2.so
2020.06.04-18:25:[email protected]: 7748c000-774a6000 r-xp 00000000 00:0c 960
/lib/libgcc_s.so.1
2020.06.04-18:25:[email protected]: 774a7000-774b6000 r-xp 00000000 00:0c 944
/lib/libuc++.so
2020.06.04-18:25:[email protected]: 774b7000-774b9000 r-xp 00000000 00:0c 959
/lib/libdl-0.9.33.2.so
2020.06.04-18:25:[email protected]: 774bb000-774d0000 r-xp 00000000 00:1f 15
/ram/pckg/dhcp/lib/libudhcp.so
2020.06.04-18:25:[email protected]: 774d2000-774d8000 r-xp 00000000 00:0c 951
/lib/liburadius.so
2020.06.04-18:25:[email protected]: 774d9000-77524000 r-xp 00000000 00:0c 956
/lib/libssl.so.1.0.0
2020.06.04-18:25:[email protected]: 77528000-77530000 r-xp 00000000 00:0c 950
/lib/libubox.so
2020.06.04-18:25:[email protected]: 77531000-7757d000 r-xp 00000000 00:0c 946
/lib/libumsg.so
2020.06.04-18:25:[email protected]: 77580000-7759d000 r-xp 00000000 00:0c 947
/lib/libucrypto.so
2020.06.04-18:25:[email protected]: 7759e000-776fb000 r-xp 00000000 00:0c 954
/lib/libcrypto.so.1.0.0
2020.06.04-18:25:[email protected]: 7770e000-77715000 r-xp 00000000 00:0c 958
/lib/ld-uClibc-0.9.33.2.so
2020.06.04-18:25:[email protected]:
2020.06.04-18:25:[email protected]: stack: 0x7f8fb000 – 0x7f8fa448
2020.06.04-18:25:[email protected]: 00 90 48 77 00 90 48 77 88 a4 8f 7f 77 d0 47
77 06 00 00 00 00 92 48 77 20 00 00 00 00 00 00 00
2020.06.04-18:25:[email protected]: cc a4 8f 7f e8 a4 8f 7f 84 a4 8f 7f e4 da 57
77 01 00 00 00 e4 da 57 77 cc a4 8f 7f 01 00 00 00
2020.06.04-18:25:[email protected]:
2020.06.04-18:25:[email protected]: code: 0x7748155b
2020.06.04-18:25:[email protected]: 5b 3d 00 f0 ff ff 76 0e 8b 93 cc ff ff ff f7
d8

This vulnerability was initially found in long-term 6.44.6, and was fixed
in stable 6.47.

Solution
========

Upgrade to the corresponding latest RouterOS tree version.

References
==========

[1] https://mikrotik.com/download/changelogs/stable-release-tree

Source link

Tagged with:



Leave a Reply

Your email address will not be published. Required fields are marked *


loading...