====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN377
_____________________________________________________________________

DATE                : 09/07/2020

HARDWARE PLATFORM(S): Netgear devices.

OPERATING SYSTEM(S): Netgear devices software running embedded web
                                     server.

=====================================================================
https://kb.cert.org/vuls/id/576779
_____________________________________________________________________


Netgear httpd upgrade_check.cgi stack buffer overflow
Vulnerability Note VU#576779
Original Release Date: 2020-06-26 | Last Revised: 2020-06-26


Overview

Multiple Netgear devices contain a stack buffer overflow in the httpd
web server's handling of upgrade_check.cgi, which may allow for
unauthenticated remote code execution with root privileges.


Description

Many Netgear devices contain an embedded web server, which is provided
by the httpd process, to provide administrative capabilities. On
multiple Netgear devices, this code fails to properly validate the
header size provided to the upgrade_check.cgi handler. Despite copying
the header to a fixed-size buffer on the stack, the vulnerable code
copies an attacker-provided count of bytes from attacker-provided data.
This allows for remote code execution by way of stack buffer overflow.
This vulnerability is exacerbated by a number of issues:

    The httpd process runs with root privileges.
    Stack cookies, which can help prevent exploitation of stack buffer
      overflows, are not universally used in Netgear devices.
    Authentication is not required to reach the vulnerable code.
    The vulnerability occurs before Cross-Site Request Forgery (CSRF)
      token checking occurs.
    Target device fingerprinting can occur by visiting the
/currentsetting.htm page on an affected device.

Exploit code that targets 79 different Netgear devices is publicly
available.


Impact

By convincing a user to visit a malicious or compromised website, a
remote, unauthenticated attacker may be able to execute arbitrary code
on a vulnerable device with root privileges.


Solution

Apply an update

Netgear has provided updates for several vulnerable devices. Note that
Netgear does not indicate when devices have reached an end of life (EOL)
state. This may be difficult to determine if a vulnerable device may
receive an update in the future.

The CERT/CC has made a spreadsheet to more clearly indicate which
devices have updates, and which devices may either be receiving an
update in the future, or may possibly be unsupported.

As outlined in the blog post It's Time to Retire Your Unsupported
Things, you should factor the vendor's support life span into purchasing
decisions. Vendors that indicate how long products will be supported
should be preferred over those that do not clearly indicate how long a
device will be supported. Similarly, vendors that clearly indicate when
a product has reached EOL state should be preferred over vendors that do
not.


Acknowledgements

This vulnerability was publicly disclosed by ZDI, who in turn credit
d4rkn3ss from VNPT ISC. Additional analysis was provided by GRIMM.

This document was written by Will Dormann.


Vendor Information

Netgear Inc. Affected


Notified:  2020-06-24 Updated: 2020-06-26

VU#576779.1	Affected


Vendor Statement

We have not received a statement from the vendor.


References


https://kb.netgear.com/000061982/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Mobile-Routers-Modems-Gateways-and-Extenders


References

    https://www.zerodayinitiative.com/advisories/ZDI-20-712/
    https://blog.grimm-co.com/2020/06/soho-device-exploitation.html

https://github.com/grimm-co/NotQuite0DayFriday/tree/master/2020.06.15-netgear

https://docs.google.com/spreadsheets/d/1Tzq97rRisoZwKNQ1pUYE6phwl4LL7KnZxc828n-hXW0/


Other Information

Date Public:            2020-06-26
Date First Published:   2020-06-26
Date Last Updated:      2020-06-26 19:20 UTC
Document Revision:      1

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================