#VU333 Heap corruption in MikroTik RouterOS
Published: August 19, 2016
Vulnerability identifier: #VU333
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: N/A
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
MikroTik RouterOS
MikroTik RouterOS
Software vendor:
MikroTik
MikroTik
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when handling user-supplied input in sshd service. A remote unauthenticated attacker can send specially crafted packets to vulnerable sshd service, trigger heap corruption and cause denial of service or execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable device.
Remediation
Update to the latest firmware version.