Full Disclosure mailing list archives
Re: Three vulnerabilities found in MikroTik's RouterOS
From: Q C <cq674350529 () gmail com>
Date: Sat, 8 May 2021 10:52:55 +0800
Hi, In Mikrotik RouterOs, each user is assigned to a user group, which denotes the rights of this user. A group policy is a combination of individual policy items, and provides a convenient way to assign different permissions and access rights to different user classes. (Reference: https://help.mikrotik.com/docs/display/ROS/User) Some common individual policy items are: web, winbox, read, write, reboot and so on. Among of them, reboot is treated as a separate permission. So an authenticated user may not have the permission to reboot the device. As to these vulnerabilities (or software bugs?), reboot permission is not required to trigger them. And they may pose an impact on the system services or even reboot the system. Of course, since authentication is still necessary to trigger them, they have a low impact. Thanks! Gynvael Coldwind <gynvael () coldwind pl> 于2021年5月8日周六 上午12:09写道:
Hi, I might be missing something, but how are these considered vulnerabilities? My point is that these require authentication, and an already authenticated user already has permissions to reboot the device anyway, right? If the above assumption is correct, then there isn't really a security boundary breach, so it would be a software bug, but not a vulnerability. Or am I missing something? Thanks, Gynvael On Fri, May 7, 2021 at 5:51 PM Q C <cq674350529 () gmail com> wrote:[update 2021/05/04] Three CVEs have been assigned to these vulnerabilities. CVE-2020-20215: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can cause a Denial of Service due to invalid memory access. CVE-2020-20216: Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/graphing process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference) CVE-2020-20213: Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU Q C <cq674350529 () gmail com> 于2020年7月22日周三 下午8:11写道:Advisory: three vulnerabilities found in MikroTik's RouterOS Details ======= Product: MikroTik's RouterOS Vendor URL: https://mikrotik.com/ Vendor Status: fixed version released CVE: - Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team Product Description ================== RouterOS is the operating system used on the MikroTik's devices, such as switch, router and access point. Description of vulnerabilities ========================== 1. Memory corruption vulnerability The diskd process suffers from a memory corruption vulnerability. By sending a crafted packet, an authenticated remote user can crash thediskdprocess due to invalid memory access. Against stable 6.44.3, the poc resulted in the following crash dump. # cat /rw/logs/backtrace.log 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: /nova/bin/diskd 2020.06.04-14:18:22.55@0: --- signal=11 -------------------------------------------- 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: eip=0x776cd1db eflags=0x00010202 2020.06.04-14:18:22.55@0: edi=0x08056760 esi=0x08056790 ebp=0x7fd40b78 esp=0x7fd40b6c 2020.06.04-14:18:22.55@0: eax=0x0000001b ebx=0x776d54ec ecx=0x776d54ec edx=0x20fe0010 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: maps: 2020.06.04-14:18:22.55@0: 08048000-08052000 r-xp 00000000 00:0c1131/nova/bin/diskd 2020.06.04-14:18:22.55@0: 77672000-776a7000 r-xp 00000000 00:0c 996 /lib/libuClibc-0.9.33.2.so 2020.06.04-14:18:22.55@0: 776ab000-776c5000 r-xp 00000000 00:0c 992 /lib/libgcc_s.so.1 2020.06.04-14:18:22.55@0: 776c6000-776d5000 r-xp 00000000 00:0c 976 /lib/libuc++.so 2020.06.04-14:18:22.55@0: 776d6000-776de000 r-xp 00000000 00:0c 982 /lib/libubox.so 2020.06.04-14:18:22.55@0: 776df000-7772b000 r-xp 00000000 00:0c 978 /lib/libumsg.so 2020.06.04-14:18:22.55@0: 77731000-77738000 r-xp 00000000 00:0c 990 /lib/ld-uClibc-0.9.33.2.so 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: stack: 0x7fd41000 - 0x7fd40b6c 2020.06.04-14:18:22.55@0: ec 54 6d 77 1b 00 00 00 88 67 05 08 98 0b d4 7f c6 c6 04 08 88 67 05 08 1b 00 00 00 10 00 fe 20 2020.06.04-14:18:22.55@0: 10 00 fe 20 ec 54 6d 77 f0 ea 6d 77 08 0c d4 7f 6d a9 6d 77 88 67 05 08 1b 00 00 00 05 00 00 00 2020.06.04-14:18:22.55@0: 2020.06.04-14:18:22.55@0: code: 0x776cd1db 2020.06.04-14:18:22.55@0: 8b 00 8b 10 01 c2 83 c2 04 52 83 c0 04 50 ff 75 This vulnerability was initially found in long-term 6.44.5, and has been fixed in stable 6.47. 2. NULL pointer dereference vulnerability The graphing process suffers from a memory corruption vulnerability. By sending a crafted packet, an authenticated remote user can crash the graphing process due to NULL pointer dereference. Against stable 6.46.5, the poc resulted in the following crash dump. # cat /rw/logs/backtrace.log 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: /nova/bin/graphing 2020.06.04-15:12:41.47@0: --- signal=11 -------------------------------------------- 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: eip=0x080521e2 eflags=0x00010202 2020.06.04-15:12:41.47@0: edi=0x080610a0 esi=0x08061cb8 ebp=0x7fa8acd8 esp=0x7fa8acb0 2020.06.04-15:12:41.47@0: eax=0x08061db8 ebx=0x7fa8ad0c ecx=0x00000000 edx=0x08061ce8 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: maps: 2020.06.04-15:12:41.47@0: 08048000-0805c000 r-xp 00000000 00:0c1038/nova/bin/graphing 2020.06.04-15:12:41.47@0: 77651000-77686000 r-xp 00000000 00:0c 964 /lib/libuClibc-0.9.33.2.so 2020.06.04-15:12:41.47@0: 7768a000-776a4000 r-xp 00000000 00:0c 960 /lib/libgcc_s.so.1 2020.06.04-15:12:41.47@0: 776a5000-776b4000 r-xp 00000000 00:0c 944 /lib/libuc++.so 2020.06.04-15:12:41.47@0: 776b5000-776bd000 r-xp 00000000 00:0c 950 /lib/libubox.so 2020.06.04-15:12:41.47@0: 776be000-7770a000 r-xp 00000000 00:0c 946 /lib/libumsg.so 2020.06.04-15:12:41.47@0: 7770d000-77717000 r-xp 00000000 00:0c 961 /lib/libm-0.9.33.2.so 2020.06.04-15:12:41.47@0: 7771c000-77723000 r-xp 00000000 00:0c 958 /lib/ld-uClibc-0.9.33.2.so 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: stack: 0x7fa8b000 - 0x7fa8acb0 2020.06.04-15:12:41.47@0: e8 1c 06 08 b8 1d 06 08 00 00 00 00 01 00 00 00 0c ad a8 7f 5b 00 00 00 b8 98 05 08 b8 98 05 08 2020.06.04-15:12:41.47@0: f0 da 6b 77 0c ad a8 7f 28 ad a8 7f 3a bc 6b 77 b8 1c 06 08 0c ad a8 7f 05 00 00 00 a0 10 06 08 2020.06.04-15:12:41.47@0: 2020.06.04-15:12:41.47@0: code: 0x80521e2 2020.06.04-15:12:41.47@0: ff 51 04 83 c4 18 6a 5c 53 e8 a0 9c ff ff 8b 56 This vulnerability was initially found in long-term 6.44.6, and has been fixed in stable 6.47. 3. Stack exhaustion vulnerability The net process suffers from a stack exhaustion vulnerability. Bysendinga crafted packet to the net process, an authenticated remote user can trigger a stack exhaustion vulnerability via recursive function calls. When testing the proof of concept on an x86 RouterOS VM, this vulnerability didn't just crash net process but caused the whole systemtoreboot. Against stable 6.46.5, the poc resulted in the following crash dump. # cat /rw/logs/backtrace.log 2020.06.08-11:19:45.40@0: 2020.06.08-11:19:45.40@0: 2020.06.08-11:19:45.40@0: /nova/bin/net 2020.06.08-11:19:45.40@0: --- signal=11 -------------------------------------------- 2020.06.08-11:19:45.40@0: 2020.06.08-11:19:45.40@0: eip=0x0809ec65 eflags=0x00010206 2020.06.08-11:19:45.40@0: edi=0x7fb0fe4c esi=0x7fb0ff48 ebp=0x7f311018 esp=0x7f310fe0 2020.06.08-11:19:45.40@0: eax=0x00fe0008 ebx=0x7772cae4 ecx=0x7772cae4 edx=0x08122630 2020.06.08-11:19:45.40@0: 2020.06.08-11:19:45.40@0: maps: 2020.06.08-11:19:45.40@0: 08048000-08121000 r-xp 00000000 00:0c1004/nova/bin/net 2020.06.08-11:19:45.40@0: 77654000-77689000 r-xp 00000000 00:0c 964 /lib/libuClibc-0.9.33.2.so 2020.06.08-11:19:45.40@0: 7768d000-776a7000 r-xp 00000000 00:0c 960 /lib/libgcc_s.so.1 2020.06.08-11:19:45.40@0: 776a8000-776b7000 r-xp 00000000 00:0c 944 /lib/libuc++.so 2020.06.08-11:19:45.40@0: 776b8000-776c6000 r-xp 00000000 00:0c 945 /lib/libz.so 2020.06.08-11:19:45.40@0: 776c7000-776d1000 r-xp 00000000 00:0c 961 /lib/libm-0.9.33.2.so 2020.06.08-11:19:45.40@0: 776d3000-776db000 r-xp 00000000 00:0c 950 /lib/libubox.so 2020.06.08-11:19:45.40@0: 776dc000-776df000 r-xp 00000000 00:0c 948 /lib/libuxml++.so 2020.06.08-11:19:45.40@0: 776e0000-7772c000 r-xp 00000000 00:0c 946 /lib/libumsg.so 2020.06.08-11:19:45.40@0: 7772f000-7774c000 r-xp 00000000 00:0c 947 /lib/libucrypto.so 2020.06.08-11:19:45.40@0: 77750000-77757000 r-xp 00000000 00:0c 958 /lib/ld-uClibc-0.9.33.2.so 2020.06.08-11:19:45.40@0: 2020.06.08-11:19:45.40@0: stack: 0x7fb10000 - 0x7f310fe0 This vulnerability was initially found in long-term 6.44.5, and has been fixed in stable 6.47. Solution ======== Upgrade to the corresponding latest RouterOS tree version. References ========== [1] https://mikrotik.com/download/changelogs/stable-release-tree_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/-- Gynvael Coldwind
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Re: Three vulnerabilities found in MikroTik's RouterOS Q C (May 07)
- Re: Three vulnerabilities found in MikroTik's RouterOS Gynvael Coldwind (May 11)
- Re: Three vulnerabilities found in MikroTik's RouterOS Q C (May 11)
- Re: Three vulnerabilities found in MikroTik's RouterOS Gynvael Coldwind (May 11)
- Re: Three vulnerabilities found in MikroTik's RouterOS Q C (May 11)
- <Possible follow-ups>
- Re: Three vulnerabilities found in MikroTik's RouterOS Q C (May 07)
- Re: Three vulnerabilities found in MikroTik's RouterOS Gynvael Coldwind (May 11)