Multiple Netgear routers 다중 취약점 발견 업데이트 권고

Overview

Netgear R7000 and R6400 routers and possibly other models are vulnerable to arbitrary command injection.

Description

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') Netgear R7000, firmware version 1.0.7.2_1.1.93 and possibly earlier, and R6400, firmware version 1.0.1.6_1.0.4 and possibly earlier, contain an arbitrary command injection vulnerability. By convincing a user to visit a specially crafted web site, a remote unauthenticated attacker may execute arbitrary commands with root privileges on affected routers. A LAN-based attacker may do the same by issuing a direct request, e.g. by visiting: http://<router_IP>/cgi-bin/;COMMAND An exploit leveraging this vulnerability has been publicly disclosed. This vulnerability has been confirmed in the R7000 and R6400 models. Community reports also indicate the R8000, firmware version 1.0.3.4_1.1.2, is vulnerable. Other models may also be affected.

Impact

By convincing a user to visit a specially crafted web site, a remote unauthenticated attacker may execute arbitrary commands with root privileges on affected routers.

Solution

The CERT/CC is currently unaware of a practical solution to this problem and recommends the following workaround.

Disable web server The very vulnerability that exists on affected routers may be used to temporarily disable the vulnerable web server until the device is restarted: http://<router_IP>/cgi-bin/;killall$IFS'httpd' Note that after performing this step, your router's web administration not be available until the device is restarted. Please see Bas' Blog for more details. Discontinue use Exploiting this vulnerability is trivial. Users who have the option of doing so should strongly consider discontinuing use of affected devices until a fix is made available.

Vendor Information (Learn More)

Vendor	Status	Date Notified	Date Updated
Netgear, Inc.	Affected	09 Dec 2016	09 Dec 2016

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C
Temporal	9.3	E:H/RL:U/RC:C
Environmental	7.0	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

• https://www.exploit-db.com/exploits/40889/
• https://cwe.mitre.org/data/definitions/77.html
• http://www.sj-vs.net/a-temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/
• https://kalypto.org/research/netgear-vulnerability-expanded/