Thursday, April 6, 2017

BroadCom UPnP Format String Preauth Root Exploit Aftermath (Few Years Later)

Hi,

Few years ago, we have discovered a remotely exploitable preauth Format
String vulnerability in Broadcom UPnP implementation used in popular
routers.
Vendors were notified and advisory was published -
http://defensecode.com/public/DefenseCode_Broadcom_Security_Advisory.pdf .
Broadcom fixed the vulnerability in their UPnP implementation and some
router vendors did it also.

Vulnerability was initially discovered on Cisco Linksys (now Belkin)
WRT54GL routers, but as stated before, vulnerable UPnP implementation
was used by many vendors.
Back in the days, Cisco fixed the vulnerability, but we are not sure
about all other router vendors and models because there are too many of
them.

When we initially discovered the vulnerability, Rapid7 also discovered
various overflows in other popular UPnP implementations, and published a
paper about it.
Rapid7 document about vulnerabilities they discovered in UPnP
implementations: https://community.rapid7.com/docs/DOC-2150
When they did the research, there were approx. 15 Million devices with
vulnerable Broadcom UPnP implementation discovered on the Internet,
probably many more in the Intranets.

We have written a paper about detailed exploitation steps for now fixed
Broadcom UPnP Format String vulnerability, but never published it due to
the severity of the bug.
Now, few years later, we feel comfortable to release a full research
paper with vulnerability details and exploitation steps for discovered
Format String vulnerability.
Big issue with routers is that they are rarely updated by users with new
firmware and there could be still a lot of vulnerable routers on the
Internet and in the Intranets.

Full research paper on discovery and exploitation of the Broadcom UPnP
Format String vulnerability can be found on the following link:

http://www.defensecode.com/whitepapers/From_Zero_To_ZeroDay_Network_Devices_Exploitation.txt

Since Broadcom and vendors that use their chipsets ship fixed versions of the UPnP implementation for some time now, the vulnerability isn't a 0day for some time. 

Still, we are sure there are plenty unpatched routers out there.

Regards,
DefenseCode Team

163 comments:

  1. It’s hard to come by experienced people about this subject, but you seem
    like you know what you’re talking about! Thanks

    Java Training in Bangalore
    iOS Training in Bangalore
    Java Training in Bangalore
    http://www.arrowtricks.com

    ReplyDelete
  2. Great Post, thanks for sharing info on BroadCom UPnP Format String Preauth Root Exploit Aftermath. Microsoft Dynamics NAV Training

    ReplyDelete
  3. You need to look at this page for some info on how to write great research project. Maybe it could be helpful for your future

    ReplyDelete
  4. Excellent blog I visit this blog it's really awesome. The important thing is that in this blog content written clearly and understandable. The content of information is very informative.
    Workday HCM Online Training!
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    ReplyDelete
  5. Your good knowledge and kindness in playing with all the pieces were very useful. I don’t know what I would have done if I had not encountered such a step like this.
    python Training institute in Chennai
    python Training institute in Bangalore

    ReplyDelete
  6. Hello! Someone in my Facebook group shared this website with us, so I came to give it a look. I’m enjoying the information. I’m bookmarking and will be tweeting this to my followers! Wonderful blog and amazing design and style.
    Data Science training in Chennai
    Data Science training in bangalore
    Data Science training institute in bangalore

    ReplyDelete
  7. Astonishing web diary I visit this blog it's incredibly magnificent. Strangely, in this blog content made doubtlessly and sensible. The substance of information is instructive.
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    ReplyDelete
  8. Great post. Thank you for sharing on UPnP Format String
    machine learning with python training

    ReplyDelete
  9. Thanks for taking time to share this valuable information admin.
    remote resource

    ReplyDelete
  10. I am really happy to read your blog. your blog is very good and informative for me.
    Your blog contain lots of information. It's such a nice post. I found your blog through my friend if you want to know about more property related information please check out here. With the experience of over 3 decades, Agrawal Construction Company is the biggest and the best builders in bhopal and the trust holder of over 10000 families. Agrawal Construction Company Bhopal is serving society, building trust & quality with a commitment to cutting-edge design and technology. Agrawal Construction Company's vision is to 'building trust & quality' which extends to developing residential, commercial and township projects in all the directions of the beautiful City of Lakes Bhopal and hence it is among the top builders in Bhopal. Currently, it has four residential such as Sagar Pearl, Sagar Green Hills, Sagar Landmark and Sagar Eden Garden.










    ReplyDelete
  11. I want to share with you the best service of an essay in the USA. On our website CustomEssayMeister., you will not only find examples of how to write an essay, but also be able to get help in writing research or coursework.

    ReplyDelete
  12. Interesting information and attractive.This blog is really rocking... Yes, the post is very interesting and I really like it.I never seen articles like this. I meant it's so knowledgeable, informative, and good looking site. I appreciate your hard work. Good job.
    Kindly visit us @
    Sathya Online Shopping
    Online AC Price | Air Conditioner Online | AC Offers Online | AC Online Shopping
    Inverter AC | Best Inverter AC | Inverter Split AC
    Buy Split AC Online | Best Split AC | Split AC Online
    LED TV Sale | Buy LED TV Online | Smart LED TV | LED TV Price
    Laptop Price | Laptops for Sale | Buy Laptop | Buy Laptop Online
    Full HD TV Price | LED HD TV Price
    Buy Ultra HD TV | Buy Ultra HD TV Online
    Buy Mobile Online | Buy Smartphone Online in India

    ReplyDelete
  13. Attend The Python Training in Hyderabad From ExcelR. Practical Python Training Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Python Training in Hyderabad.
    python training in bangalore

    ReplyDelete
  14. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    ReplyDelete
  15. Thanks for a nice share you have given to us with such an large collection of information.
    Great work you have done by sharing them to all.
    simply superb.construction company in bhopal
    Best Builders in bhopal
    Plots in Bhopal
    singlex, Duplex houses in bhopal
    coloniser in bhopal
    real estate developers in bhopal

    ReplyDelete
  16. The article is very interesting and very understood to be read, may be useful for the people. I wanted to thank you for this great read!! I definitely enjoyed every little bit of it. I have to bookmarked to check out new stuff on your post. Thanks for sharing the information keep updating, looking forward for more posts..
    Kindly visit us @ Madurai Travels | Best Travels in Madurai | Cabs in Madurai
    Tours and Travels in Madurai

    ReplyDelete
  17. Excellent Blog. I really want to admire the quality of this post. I like the way of your presentation of ideas, views and valuable content. No doubt you are doing great work. I’ll be waiting for your next post. Thanks .Keep it up!
    Kindly visit us @
    Luxury Packaging Box
    Wallet Box
    Perfume Box Manufacturer
    Candle Packaging Boxes
    Luxury Leather Box
    Luxury Clothes Box
    Luxury Cosmetics Box
    Shoe Box Manufacturer
    Luxury Watch Box

    ReplyDelete
  18. Your blog really nice. Its sound really good. I am very time read your blog. Thanks for the sharing this blog with us. Keep it up.
    seo company in india

    ReplyDelete
  19. Thanks for sharing this useful information. it's very informative content. Keep sharing.
    wooden eyeglass frames

    ReplyDelete
  20. Valore London creates handcrafted leather goods of the highest quality, combining the anecdote of Italian craftsmanship with the innovation of contemporary British design.
    dokumentenmappe leder
    schulrucksack
    pack easy koffer

    ReplyDelete
  21. Today, I visit your website and after reading your blog i realize that it is very informative. I'm highly impressed to see the comprehensive resources being offered by your site.
    African clothing for Men
    Mens African Clothing

    ReplyDelete
  22. very nice
    http://www.eskisehircilingir.biz/

    ReplyDelete
  23. I enjoyed it, thanks for posting it, I hope this post of yours will be more appreciated by it really excellent. I do not feel sorry for taking the time to read this post, it is really nice and useful to me, thanks for posting it.
    Jogo para criança, friv school 2019, cá koi mini, friv4school 2020

    ReplyDelete

  24. I recently visited your blog and it is a very impressive blog and you have got some interesting details in this post. Provide enough knowledge for me. Thank you for sharing the useful post and Well do...
    Corporate Training in Chennai
    Corporate Training
    Power BI Training in Chennai
    Unix Training in Chennai
    Linux Training in Chennai
    Pega Training in Chennai
    Oracle DBA Training in Chennai
    job Openings in chennai
    Corporate Training in Porur
    Corporate Training in T Nagar

    ReplyDelete
  25. This comment has been removed by the author.

    ReplyDelete
  26. Business Analytics or Data Analytics or data science training in hyderabad is an extremely popular, in-demand profession which requires a professional to possess sound knowledge of analysing data in all dimensions and uncover the unseen truth coupled with logic and domain knowledge to impact the top-line (increase business) and bottom-line (increase revenue). ExcelR’s Data Science curriculum is meticulously designed and delivered matching the industry needs and considered to be the best in the industry.

    ReplyDelete
  27. Hi there, just became aware of your blog through Google, and found that it’s really informative
    Regards
    Factocert
    iso certification in UAE
    iso certification in Saudi Arabia

    ReplyDelete
  28. I visit your web page. It is really useful and easy to understand. Hope everyone get benefit. Thanks for sharing your Knowledge and experience with us.
    McAfee Activate - Follow the steps for uninstalling, downloading, installing and activating McAfee antivirus. Visit us, enter the 25-digit activation code, click submit. | norton.com/nu16 | mcafee.com/activate |norton.com/nu16

    ReplyDelete
  29. Office Setup - Are you looking for the steps to download and install the Office Setup to the device? Here is the simplest method to do so. Activate your Office product by visiting office.com/setup office.com/setup

    ReplyDelete

  30. Norton setup - Get started with Norton by downloading the setup and installing it on the device. Enter the unique 25-character alphanumeric product key for activation. Check your subscription norton.com/setup | norton.com/setup | norton.com/setup

    ReplyDelete
  31. BookMyCostume.com is your online destination for all your kids’ fancy dress costumes needs. We are the leading online store in India that offers delivery and return pickup to and from your doorstep,
    boys fancy dress
    superhero fancy dress
    fancy dresses for girls

    ReplyDelete
  32. Nice knowledge gaining article. This post is really the best on this valuable topic.

    mcafee.com/activate
    mcafee.com/activate
    mcafee.com/activate

    ReplyDelete
  33. Attend The Course in Data Analytics From ExcelR. Practical Course in Data Analytics Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Course in Data Analytics.
    ExcelR Course in Data Analytics

    ReplyDelete
  34. Thanks for sharing this post.Keep sharing more like this. Machine Learning Course

    ReplyDelete
  35. At Regulus, all of our employees, whether full-time, leased, temporary or internal are just as important. Best IT Consulting Company In USA We’ll take the time to get to know you and understand your needs and requirements on an individual basis, and we’ll match your skills to our clients’ requirements. Our understanding and commitment to each individual employee and their goals is what you will get when you work with us.

    ReplyDelete
  36. Put more information on this page, I really like your blog more. OGEN Infosystem is presented Top 5 Website Designing Company in India and they have also experienced team of Digital Marketing for SEO, PPC, and other social media activities.
    Website Designing Company in Delhi

    ReplyDelete
  37. Really useful information. Thank you so much for sharing.It will help everyone.Keep Post. Artificial Intelligence Course

    ReplyDelete
  38. Buy home decor items online and surveillance CCTV cameras for home security at Arohha.com. Browse a wide range of wifi CCTV camera, wireless CCTV camera, hidden camera, IP camera, analog camera & home decor items online at the best price in Delhi NCR
    home security camera system in Delhi NCR
    security cameras in Delhi NCR
    home furniture online in Delhi NCR
    analog camera in Delhi NCR
    wireless cctv camera in Delhi NCR
    camera for home in Delhi NCR
    ip camera in Delhi NCR
    kitchen accessories online shopping in Delhi NCR

    ReplyDelete
  39. Get a creative website design and user friendly website with us in United States.

    IDesignPassion

    ReplyDelete
  40. Great post. I am facing some of these issues as well..
    cell phone service center bangalore
    Way cool! Some very valid points! I appreciate you penning this write-up and also the rest of the website is extremely good.
    Vivo display replacement Marathahalli
    Excellent blog you've got here.. It’s difficult to find high-quality writing like yours nowadays. I seriously appreciate people like you! Take care!!
    Motorola display replacement Marathahalli

    ReplyDelete
  41. When I initially left a comment I appear to have clicked the -Notify me when new comments are added- checkbox and now each time a comment is added online google pixel display repair I receive four emails with the exact same comment. There has to be an easy method you can remove me from that service? Kudos! online lg display repair | online mobile repair marathahalli

    ReplyDelete
  42. online mobile service center bangalore

    I was more than happy to uncover this great site. I need to to thank you for your time due to this fantastic read!! I definitely enjoyed every bit of it and I have you bookmarked to see new information on your blog.

    iphone service center bangalore

    samsung service center bangalore

    May I simply just say what a relief to discover someone that actually knows what they are talking about online. You actually know how to bring an issue to light and make it important. A lot more people ought to look at this and understand this side of the story. It's surprising you aren't more popular given that you definitely possess the gift.

    microsoft service center bangalore
    It’s hard to come by experienced people about this subject, but you seem like you know what you’re talking about! Thanks

    oneplus service center bangalore
    Very good write-up. I certainly love this website. Thanks!

    google pixel service center bangalore

    ReplyDelete
  43. This comment has been removed by the author.

    ReplyDelete
  44. This comment has been removed by the author.

    ReplyDelete
  45. Excellent blog you've got here.. It’s difficult to find high-quality writing like yours nowadays. I seriously appreciate people like you! Take care!!
    top mobile service center bangalore
    This is a topic which is close to my heart... Thank you! Exactly where are your contact details though?
    Vivo display replacement Marathahalli
    I absolutely love your blog.. Pleasant colors & theme. Did you build this web site yourself? Please reply back as I’m trying to create my own personal website and would love to know where you got this from or what the theme is called. Thanks!
    Motorola display replacement Marathahalli

    ReplyDelete
  46. I really like it when people get together and share ideas. Great blog, stick with it!
    Huawei display replacement Marathahalli
    Good information. Lucky me I ran across your site by chance (stumbleupon). I have saved as a favorite for later!
    Asus display replacement Marathahalli
    This website was... how do I say it? Relevant!! Finally I have found something which helped me. Thanks!
    LG display replacement Marathahalli

    ReplyDelete
  47. ترجمه تخصصی کامپیوتر یکی از کاربردی ترین ترجمه ها میباشد که ما ان را با بالاترین کیفیت برا شما انجام میدهیم

    ReplyDelete
  48. Great blog thanks for sharing Consistent and relevant content is the best ways to drive in massive amounts of traffic to your website through Search Engines. Adhuntt Media’s content creation team has got everything covered for you - from high-grade blogs that engage the reader and hit all the sweet SEO spots, unique design posts for your social media feed and professional videos for video marketing.
    digital marketing agency in chennai

    ReplyDelete
  49. Nice blog thanks for sharing It’s time you made the decision to upgrade your garden to the next level. For this you need the best variety and service available. Karuna Nursery Gardens can help you with that part by being the best place to buy plants in Chennai at amazing deals.
    plant nursery in chennai

    ReplyDelete
  50. Excellent blog thanks for sharing Pixies Beauty Shop is unlike any of the other cosmetic shops in Chennai. With tons of exclusive imported brands to choose from and the best value, this is the best shopping destination for your personal and salon needs.
    Cosmetics Shop in Chennai

    ReplyDelete
  51. Very interesting blog Thank you for sharing such a nice and interesting blog and really very helpful article.html training in bangalore

    ReplyDelete
  52. Its really helpful for the users of this site. I am also searching about these type of sites now a days. So your site really helps me for searching the new and great stuff.css training in bangalore

    ReplyDelete
  53. Very useful and information content has been shared out here, Thanks for sharing it.php training in bangalore

    ReplyDelete
  54. I gathered a lot of information through this article.Every example is easy to undestandable and explaining the logic easily.mysql training in bangalore

    ReplyDelete
  55. These provided information was really so nice,thanks for giving that post and the more skills to develop after refer that post.javascript training in bangalore

    ReplyDelete
  56. Your articles really impressed for me,because of all information so nice.angularjs training in bangalore

    ReplyDelete
  57. Linking is very useful thing.you have really helped lots of people who visit blog and provide them use full information.angular 2 training in bangalore

    ReplyDelete
  58. Being new to the blogging world I feel like there is still so much to learn. Your tips helped to clarify a few things for me as well as giving.angular 4 training in bangalore

    ReplyDelete
  59. Really it was an awesome article,very interesting to read.You have provided an nice article,Thanks for sharing.angular 7 training in bangalore

    ReplyDelete
  60. I know that it takes a lot of effort and hard work to write such an informative content like this.node.js training in bangalore

    ReplyDelete
  61. Great Article! Thanks for sharing this types of article is very helpful for us! If you have any type of pain like chronic pain, back pain etc.
    Best Pharmacy Shop
    Order Pharmacy Online
    Buy Caverta Online
    Buy Abamune Online
    Buy Acaprol Online
    Buy Admenta Online
    Order Admenta Online

    ReplyDelete
  62. This comment has been removed by the author.

    ReplyDelete
  63. Great tips and very easy to understand. This will definitely be very useful for me when I get a chance to start my blog. ExcelR Data Science Training Pune

    ReplyDelete
  64. Right here is the right webpage for everyone who hopes to understand this topic. You know a whole lot its almost hard to argue with you (not that I personally would want to…HaHa). You certainly put a fresh spin on a topic that has been discussed for many years. Excellent stuff, just excellent! onsite mobile repair bangalore Aw, this was a very good post. Spending some time and actual effort to create a good article… but what can I say… I procrastinate a whole lot and never seem to get anything done. asus display repair bangalore I’m impressed, I have to admit. Seldom do I encounter a blog that’s equally educative and interesting, and without a doubt, you've hit the nail on the head. The problem is something that too few folks are speaking intelligently about. I'm very happy I stumbled across this during my search for something relating to this. huawei display repair bangalore

    ReplyDelete
  65. Oh my goodness! Incredible article dude! Many thanks, However I am encountering difficulties with your RSS. I don’t understand the reason why I cannot join it. Is there anyone else having the same RSS issues? Anyone who knows the answer will you kindly respond? Thanks!! online laptop repair center bangalore An outstanding share! I've just forwarded this onto a coworker who had been doing a little research on this. And he in fact ordered me breakfast because I found it for him... lol. So allow me to reword this.... Thank YOU for the meal!! But yeah, thanks for spending some time to talk about this matter here on your internet site. dell repair center bangalore

    ReplyDelete
  66. After going over a handful of the articles on your website, I truly appreciate your technique of writing a blog. I book-marked it to my bookmark website list and will be checking back soon. Please visit my web site too and tell me what you think. macbook repair center bangalore This website definitely has all of the information and facts I needed about this subject and didn’t know who to ask. acer repair center bangalore

    ReplyDelete
  67. Nice to be visiting your blog once more, it has been months for me. Well this article that ive been waited for therefore long. i want this article to finish my assignment within the faculty, and it has same topic together with your article. Thanks, nice share.
    ExcelR Data Analytics Course

    ReplyDelete
  68. This is also a very good post which I really enjoyed reading. It is not every day that I have the possibility to see something like this.. best data science course in bangalore

    ReplyDelete
  69. I am looking for and I love to post a comment that "The content of your post is awesome" Great work!
    Know Data Science Course Pune

    ReplyDelete
  70. Very Nice Blog!!! Thanks for Sharing Awesome Blog!! Prescription medicines are now easy to purchase. You can order here.
    Buy Gabapentin Cash on delivery
    Buy Gabapentin Online
    how to order Gabapentin 300mg online
    Gabapentin 600mg online

    ReplyDelete