Security News Turn off remote admin, SOHOpeless D-Link owners

[Jack]

It's 2016, and D-Link still can't get its Home Network Automation Protocol (HNAP) implementation right.

In a terse advisory, the Carnegie-Mellon CERT says the HNAP service in D-Link's "DIR" range of routers has a stack-based buffer overflow.

“Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack. The vulnerable XML fields within the SOAP body are: Action, Username, LoginPassword, and Captcha”, the advisory states.

So far, the advisory says, D-Link hasn't addressed the problem, which affects its DIR-823, DIR-822, DIR-818L(W), DIR-895L, DIR-890L, DIR-885L, DIR-880L and DIR-868L units.

The only workaround is to disable remote administration.

Agile Information Security's Pedro Ribeiro reported the issue, and has a Metasploit proof-of-concept here.

Ribeiro explains that the vulnerable fields accept arbitrarily long string and copies them into the stack. The processor the vulnerable devices use, Lextra RLX (which Ribeiro describes as “crippled MIPS cores”, can't cope, and crash.

There are two ways to crash the stack, Ribeiro writes: the first is to send one of the vulnerable fields a string more than 3096 bytes long; the second is to overrun the stack of the calling function, hnap_main, with 2048+ bytes.

If this sounds familiar, it's because you've got a long memory. For example, six years ago, SourceSec Security Research reported (PDF) bugs in the HNAP implementation.

Read more: Turn off remote admin, SOHOpeless D-Link owners

 

[frogboy]

Phew just got home from work and my router is unaffected I have waiting for the last hour to get home and check.

 

[tim one]

One of the flaws most often used by hackers to enter the routers are based on Buffer Overflow errors being generated when it sends to a device a string longer than the buffer, provided by the programmer, to handle it. This, then, ends up in the memory areas already occupied and it happens ... anything.
Unfortunately, the requests to be handled in a firmware or network software are so many and it can happen to forget the validation in some case.

 

[shmu26]

In my D-Link router, I have two remote control LAN settings that are enabled, and greyed out, so I can't untick them.
they are:
HTTP
ICMP

what to do?

 

[Solarquest]

It happens again...if they don't fix it within a reasonable, SHORT, time, we need fines!!!
Remote admin should be disabled anyway from devices since a long time..too dangerous to have it enabled!
User have then to login and update their router firmware manually, at least on some devices(e.g, mine).

 

[jamescv7]

The problem here where majority of routers firmware are out of date and usually slow on providing patch updates.

So a clear shot that it can be very easy to be vulnerable on such common attacks.