Multiple vulnerabilities in Mikrotik RouterOS



Published: 2019-07-01
Risk Medium
Patch available YES
Number of vulnerabilities 6
CVE ID CVE-2019-11477
CVE-2019-11478
CVE-2019-11479
CVE-2014-8160
CVE-2019-13074
CVE-2018-10066
CWE ID CWE-190
CWE-400
CWE-399
CWE-264
CWE-300
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
MikroTik RouterOS
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor MikroTik

Security Advisory

1) Integer overflow

Risk: Medium

CVSSv3: 6.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-11477

CWE-ID: CWE-190 - Integer Overflow or Wraparound

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to integer overflow when handling TCP Selective Acknowledgments (SACKs) due to incorrect processing of TCP_SKB_CB(skb)->tcp_gso_segs value in Linux kernel. A remote non-authenticated attacker can send specially crafted network traffic to the affected system, trigger integer overflow and render the system unavailable.

Successful exploitation of the vulnerability allows a remote attacker to perform denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MikroTik RouterOS: 6.41, 6.41.1, 6.41.2, 6.41.3, 6.41.4, 6.42, 6.42.1, 6.42.2, 6.42.3, 6.42.4, 6.42.5, 6.42.6, 6.42.7, 6.42.9, 6.42.10, 6.42.11, 6.42.12, 6.43, 6.43.1, 6.43.2, 6.43.3, 6.43.4, 6.43.5, 6.43.6, 6.43.7, 6.43.8, 6.43.9, 6.43.10, 6.43.11, 6.43.12, 6.43.13, 6.43.14, 6.43.15, 6.43.16, 6.44, 6.44.1, 6.44.2, 6.44.3

CPE External links

https://mikrotik.com/download/changelogs/#6.45.1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

Risk: Medium

CVSSv3: 6.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-11478

CWE-ID: CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to an error when processing TCP Selective Acknowledgment (SACK) sequences within the Linux kernel TCP retransmission queue implementation in tcp_fragment. A remote non-authenticated attacker can send specially crafted network traffic to the affected system and perform a denial of service (DoS) attack.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

MikroTik RouterOS: 6.41, 6.41.1, 6.41.2, 6.41.3, 6.41.4, 6.42, 6.42.1, 6.42.2, 6.42.3, 6.42.4, 6.42.5, 6.42.6, 6.42.7, 6.42.9, 6.42.10, 6.42.11, 6.42.12, 6.43, 6.43.1, 6.43.2, 6.43.3, 6.43.4, 6.43.5, 6.43.6, 6.43.7, 6.43.8, 6.43.9, 6.43.10, 6.43.11, 6.43.12, 6.43.13, 6.43.14, 6.43.15, 6.43.16, 6.44, 6.44.1, 6.44.2, 6.44.3

CPE External links

https://mikrotik.com/download/changelogs/#6.45.1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource exhaustion

Risk: Medium

CVSSv3: 6.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-11479

CWE-ID: CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to presence of hard-coded MSS value (48 bytes) in the Linux kernel source code. A remote attacker can fragment TCP resend queues significantly more than if a larger MSS were enforced and perform denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MikroTik RouterOS: 6.41, 6.41.1, 6.41.2, 6.41.3, 6.41.4, 6.42, 6.42.1, 6.42.2, 6.42.3, 6.42.4, 6.42.5, 6.42.6, 6.42.7, 6.42.9, 6.42.10, 6.42.11, 6.42.12, 6.43, 6.43.1, 6.43.2, 6.43.3, 6.43.4, 6.43.5, 6.43.6, 6.43.7, 6.43.8, 6.43.9, 6.43.10, 6.43.11, 6.43.12, 6.43.13, 6.43.14, 6.43.15, 6.43.16, 6.44, 6.44.1, 6.44.2, 6.44.3

CPE External links

https://mikrotik.com/download/changelogs/#6.45.1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource management error

Risk: Medium

CVSSv3: 5.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2014-8160

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel generates incorrect conntrack entries when handling certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols. A remote attacker can send packets with disallowed port numbers to the affected system and bypass iptables filtering rules. 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MikroTik RouterOS: 6.41, 6.41.1, 6.41.2, 6.41.3, 6.41.4, 6.42, 6.42.1, 6.42.2, 6.42.3, 6.42.4, 6.42.5, 6.42.6, 6.42.7, 6.42.9, 6.42.10, 6.42.11, 6.42.12, 6.43, 6.43.1, 6.43.2, 6.43.3, 6.43.4, 6.43.5, 6.43.6, 6.43.7, 6.43.8, 6.43.9, 6.43.10, 6.43.11, 6.43.12, 6.43.13, 6.43.14, 6.43.15, 6.43.16, 6.44, 6.44.1, 6.44.2, 6.44.3

CPE External links

https://mikrotik.com/download/changelogs/#6.45.1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Permissions, Privileges, and Access Controls

Risk: Medium

CVSSv3: 6.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-13074

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to unspecified error. A remote attacker can bypass certain security restrictions.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

MikroTik RouterOS: 6.41, 6.41.1, 6.41.2, 6.41.3, 6.41.4, 6.42, 6.42.1, 6.42.2, 6.42.3, 6.42.4, 6.42.5, 6.42.6, 6.42.7, 6.42.9, 6.42.10, 6.42.11, 6.42.12, 6.43, 6.43.1, 6.43.2, 6.43.3, 6.43.4, 6.43.5, 6.43.6, 6.43.7, 6.43.8, 6.43.9, 6.43.10, 6.43.11, 6.43.12, 6.43.13, 6.43.14, 6.43.15, 6.43.16, 6.44, 6.44.1, 6.44.2, 6.44.3

CPE External links

https://mikrotik.com/download/changelogs/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Man-in-the-Middle (MitM) attack

Risk: Low

CVSSv3: 3 [CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10066

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform man-in-the-middle (MitM) attack.

The vulnerability exists due to missing OpenVPN server certificate verification. A remote attacker can perform MitM attack and trick the affected device to connect to a malicious OpenVPN server.

Successful exploitation of this vulnerability may allow an attacker to gain unauthorized access to a local network, behind the Mikrotik router.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MikroTik RouterOS: 6.41, 6.41.1, 6.41.2, 6.41.3, 6.41.4, 6.42, 6.42.1, 6.42.2, 6.42.3, 6.42.4, 6.42.5, 6.42.6, 6.42.7, 6.42.9, 6.42.10, 6.42.11, 6.42.12, 6.43, 6.43.1, 6.43.2, 6.43.3, 6.43.4, 6.43.5, 6.43.6, 6.43.7, 6.43.8, 6.43.9, 6.43.10, 6.43.11, 6.43.12, 6.43.13, 6.43.14, 6.43.15, 6.43.16, 6.44, 6.44.1, 6.44.2, 6.44.3

CPE External links

https://janis-streib.de/2018/04/11/mikrotik-openvpn-security

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.