Security Advisory

IS-2010-006 - D-Link DAP-1160 formFilter buffer overflow



Advisory Information
--------------------
Published:
2010-07-14

Updated:
2010-07-14

Manufacturer: D-Link
Model: DAP-1160
Firmware version: 1.20b06
          1.30b10
          1.31b01



Vulnerability Details
---------------------

Public References:
Not Assigned


Platform:
Successfully tested on D-Link DAP-1160 loaded with firmware versions:
v120b06, v130b10, v131b01.
Other models and/or firmware versions may be also affected.
Note: Only firmware version major numbers are displayed on the
administration web interface: 1.20, 1.30, 1.31


Background Information:
D-Link DAP-1160 is a wireless access points that allow wireless clients
connectivity to wired networks.
Supported 802.11b and 802.11g protocols. WEP, WPA and WPA2 supported.


Summary:
A buffer overflow condition can be triggered by setting URL filtering
for an overly long URL, leading to possible arbitrary code execution or
denial of service. Successful authentication is required in order to
exploit the vulnerability, but attackers can leverage other
vulnerabilities for achieving unauthenticated remote exploitation.


Details:
Changing the device configuration involves sending a properly formatted
POST request to the following URL:
http://IP_ADDR/apply.cgi?formhandler_func 

where IP_ADDR is the device IP address and the formhandler_func is a
function, specific to the task to be accomplished, that will handle the
POST parameters present in the request body.

The formFilter() function can be used for applying specific filters to
the communication going through the Access Point, and is not accessible
through any of the links available on the device administration interface.
Nonetheless, the web page available at the following URL

http://IP_ADDR/adv_webfilter.htm 

relies on such function for applying URL filters.

One of the functionalities formFilter function allows for is URL
filtering performed on a specific URL, submitted via the above mentioned
web page or by sending a properly formatted POST request.
The provided URL is copied on the stack in a fixed sizer buffer,
allowing for buffer overflow and possible arbitrary code execution with
root privileges, if an overly long URL is provided.

A successful authentication is required in order to be able to to
trigger the vulnerability, but an attacker may leverage DCC protocol and
authentication bypass vulnerability for achieving unauthenticated remote
exploitation.

Impacts:
Arbitrary code execution
Denial of service


Solutions & Workaround:
Not available



Additional Information
----------------------
Timeline (dd/mm/yy):
17/02/2010: Vulnerability discovered
17/02/2010: No suitable technical/security contact on Global/Regional
website. No contact available on OSVDB website
18/02/2010: Point of contact requested to customer service
----------- No response -----------
26/05/2010: Vulnerability disclosed at CONFidence 2010
14/07/2010: This advisory


Additional information available at http://www.icysilence.org