SB2021081709 - Multiple vulnerabilities in Realtek SDK
Published: August 17, 2021 Updated: August 25, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2021-35392)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Buffer overflow (CVE-ID: CVE-2021-35395)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in multiple parameters. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
This vulnerability affects the following parameters:
- "submit-url" parameter in formRebootCheck/formWsc/formWlanMultipleAP
- "ifname" parameter in formWlSiteSurvey
- "hostname" parameter in formStaticDHCP
- "peerPin" parameter in formWsc
Note, as of August 19 the vulnerability is being exploited in-the-wild by the Mirai botnet.
3) OS Command Injection (CVE-ID: CVE-2021-35394)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation within the MP Daemon diagnostic tool. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Heap-based buffer overflow (CVE-ID: CVE-2021-35393)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.