Thursday, April 6, 2017

BroadCom UPnP Format String Preauth Root Exploit Aftermath (Few Years Later)

Hi,

Few years ago, we have discovered a remotely exploitable preauth Format
String vulnerability in Broadcom UPnP implementation used in popular
routers.
Vendors were notified and advisory was published -
http://defensecode.com/public/DefenseCode_Broadcom_Security_Advisory.pdf .
Broadcom fixed the vulnerability in their UPnP implementation and some
router vendors did it also.

Vulnerability was initially discovered on Cisco Linksys (now Belkin)
WRT54GL routers, but as stated before, vulnerable UPnP implementation
was used by many vendors.
Back in the days, Cisco fixed the vulnerability, but we are not sure
about all other router vendors and models because there are too many of
them.

When we initially discovered the vulnerability, Rapid7 also discovered
various overflows in other popular UPnP implementations, and published a
paper about it.
Rapid7 document about vulnerabilities they discovered in UPnP
implementations: https://community.rapid7.com/docs/DOC-2150
When they did the research, there were approx. 15 Million devices with
vulnerable Broadcom UPnP implementation discovered on the Internet,
probably many more in the Intranets.

We have written a paper about detailed exploitation steps for now fixed
Broadcom UPnP Format String vulnerability, but never published it due to
the severity of the bug.
Now, few years later, we feel comfortable to release a full research
paper with vulnerability details and exploitation steps for discovered
Format String vulnerability.
Big issue with routers is that they are rarely updated by users with new
firmware and there could be still a lot of vulnerable routers on the
Internet and in the Intranets.

Full research paper on discovery and exploitation of the Broadcom UPnP
Format String vulnerability can be found on the following link:

http://www.defensecode.com/whitepapers/From_Zero_To_ZeroDay_Network_Devices_Exploitation.txt

Since Broadcom and vendors that use their chipsets ship fixed versions of the UPnP implementation for some time now, the vulnerability isn't a 0day for some time. 

Still, we are sure there are plenty unpatched routers out there.

Regards,
DefenseCode Team

64 comments:

  1. It’s hard to come by experienced people about this subject, but you seem
    like you know what you’re talking about! Thanks

    Java Training in Bangalore
    iOS Training in Bangalore
    Java Training in Bangalore
    http://www.arrowtricks.com

    ReplyDelete
  2. Great Post, thanks for sharing info on BroadCom UPnP Format String Preauth Root Exploit Aftermath. Microsoft Dynamics NAV Training

    ReplyDelete
  3. You need to look at this page for some info on how to write great research project. Maybe it could be helpful for your future

    ReplyDelete
  4. Excellent blog I visit this blog it's really awesome. The important thing is that in this blog content written clearly and understandable. The content of information is very informative.
    Workday HCM Online Training!
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    ReplyDelete
  5. Your good knowledge and kindness in playing with all the pieces were very useful. I don’t know what I would have done if I had not encountered such a step like this.
    python Training institute in Chennai
    python Training institute in Bangalore

    ReplyDelete
  6. Hello! Someone in my Facebook group shared this website with us, so I came to give it a look. I’m enjoying the information. I’m bookmarking and will be tweeting this to my followers! Wonderful blog and amazing design and style.
    Data Science training in Chennai
    Data Science training in bangalore
    Data Science training institute in bangalore

    ReplyDelete
  7. Astonishing web diary I visit this blog it's incredibly magnificent. Strangely, in this blog content made doubtlessly and sensible. The substance of information is instructive.
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    ReplyDelete
  8. Great post. Thank you for sharing on UPnP Format String
    machine learning with python training

    ReplyDelete
  9. Thanks for taking time to share this valuable information admin.
    remote resource

    ReplyDelete
  10. I am really happy to read your blog. your blog is very good and informative for me.
    Your blog contain lots of information. It's such a nice post. I found your blog through my friend if you want to know about more property related information please check out here. With the experience of over 3 decades, Agrawal Construction Company is the biggest and the best builders in bhopal and the trust holder of over 10000 families. Agrawal Construction Company Bhopal is serving society, building trust & quality with a commitment to cutting-edge design and technology. Agrawal Construction Company's vision is to 'building trust & quality' which extends to developing residential, commercial and township projects in all the directions of the beautiful City of Lakes Bhopal and hence it is among the top builders in Bhopal. Currently, it has four residential such as Sagar Pearl, Sagar Green Hills, Sagar Landmark and Sagar Eden Garden.










    ReplyDelete
  11. I want to share with you the best service of an essay in the USA. On our website CustomEssayMeister., you will not only find examples of how to write an essay, but also be able to get help in writing research or coursework.

    ReplyDelete
  12. Interesting information and attractive.This blog is really rocking... Yes, the post is very interesting and I really like it.I never seen articles like this. I meant it's so knowledgeable, informative, and good looking site. I appreciate your hard work. Good job.
    Kindly visit us @
    Sathya Online Shopping
    Online AC Price | Air Conditioner Online | AC Offers Online | AC Online Shopping
    Inverter AC | Best Inverter AC | Inverter Split AC
    Buy Split AC Online | Best Split AC | Split AC Online
    LED TV Sale | Buy LED TV Online | Smart LED TV | LED TV Price
    Laptop Price | Laptops for Sale | Buy Laptop | Buy Laptop Online
    Full HD TV Price | LED HD TV Price
    Buy Ultra HD TV | Buy Ultra HD TV Online
    Buy Mobile Online | Buy Smartphone Online in India

    ReplyDelete
  13. Attend The Python Training in Hyderabad From ExcelR. Practical Python Training Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Python Training in Hyderabad.
    python training in bangalore

    ReplyDelete
  14. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    ReplyDelete
  15. Thanks for a nice share you have given to us with such an large collection of information.
    Great work you have done by sharing them to all.
    simply superb.construction company in bhopal
    Best Builders in bhopal
    Plots in Bhopal
    singlex, Duplex houses in bhopal
    coloniser in bhopal
    real estate developers in bhopal

    ReplyDelete
  16. The article is very interesting and very understood to be read, may be useful for the people. I wanted to thank you for this great read!! I definitely enjoyed every little bit of it. I have to bookmarked to check out new stuff on your post. Thanks for sharing the information keep updating, looking forward for more posts..
    Kindly visit us @ Madurai Travels | Best Travels in Madurai | Cabs in Madurai
    Tours and Travels in Madurai

    ReplyDelete
  17. Excellent Blog. I really want to admire the quality of this post. I like the way of your presentation of ideas, views and valuable content. No doubt you are doing great work. I’ll be waiting for your next post. Thanks .Keep it up!
    Kindly visit us @
    Luxury Packaging Box
    Wallet Box
    Perfume Box Manufacturer
    Candle Packaging Boxes
    Luxury Leather Box
    Luxury Clothes Box
    Luxury Cosmetics Box
    Shoe Box Manufacturer
    Luxury Watch Box

    ReplyDelete
  18. Your blog really nice. Its sound really good. I am very time read your blog. Thanks for the sharing this blog with us. Keep it up.
    seo company in india

    ReplyDelete
  19. Thanks for sharing this useful information. it's very informative content. Keep sharing.
    wooden eyeglass frames

    ReplyDelete
  20. Valore London creates handcrafted leather goods of the highest quality, combining the anecdote of Italian craftsmanship with the innovation of contemporary British design.
    dokumentenmappe leder
    schulrucksack
    pack easy koffer

    ReplyDelete
  21. Today, I visit your website and after reading your blog i realize that it is very informative. I'm highly impressed to see the comprehensive resources being offered by your site.
    African clothing for Men
    Mens African Clothing

    ReplyDelete
  22. very nice
    http://www.eskisehircilingir.biz/

    ReplyDelete
  23. I enjoyed it, thanks for posting it, I hope this post of yours will be more appreciated by it really excellent. I do not feel sorry for taking the time to read this post, it is really nice and useful to me, thanks for posting it.
    Jogo para criança, friv school 2019, cá koi mini, friv4school 2020

    ReplyDelete

  24. I recently visited your blog and it is a very impressive blog and you have got some interesting details in this post. Provide enough knowledge for me. Thank you for sharing the useful post and Well do...
    Corporate Training in Chennai
    Corporate Training
    Power BI Training in Chennai
    Unix Training in Chennai
    Linux Training in Chennai
    Pega Training in Chennai
    Oracle DBA Training in Chennai
    job Openings in chennai
    Corporate Training in Porur
    Corporate Training in T Nagar

    ReplyDelete
  25. This comment has been removed by the author.

    ReplyDelete
  26. Business Analytics or Data Analytics or data science training in hyderabad is an extremely popular, in-demand profession which requires a professional to possess sound knowledge of analysing data in all dimensions and uncover the unseen truth coupled with logic and domain knowledge to impact the top-line (increase business) and bottom-line (increase revenue). ExcelR’s Data Science curriculum is meticulously designed and delivered matching the industry needs and considered to be the best in the industry.

    ReplyDelete
  27. Hi there, just became aware of your blog through Google, and found that it’s really informative
    Regards
    Factocert
    iso certification in UAE
    iso certification in Saudi Arabia

    ReplyDelete
  28. I visit your web page. It is really useful and easy to understand. Hope everyone get benefit. Thanks for sharing your Knowledge and experience with us.
    McAfee Activate - Follow the steps for uninstalling, downloading, installing and activating McAfee antivirus. Visit us, enter the 25-digit activation code, click submit. | norton.com/nu16 | mcafee.com/activate |norton.com/nu16

    ReplyDelete
  29. Office Setup - Are you looking for the steps to download and install the Office Setup to the device? Here is the simplest method to do so. Activate your Office product by visiting office.com/setup office.com/setup

    ReplyDelete

  30. Norton setup - Get started with Norton by downloading the setup and installing it on the device. Enter the unique 25-character alphanumeric product key for activation. Check your subscription norton.com/setup | norton.com/setup | norton.com/setup

    ReplyDelete