A vulnerability has been found in KCodes NetUSB which is a Linux kernel module that enables several users on a local network to share USB-based services over IP. The vulnerability in question, CVE-2015-3036, is a buffer overflow that could enable an attacker to either crash the device running the kernel module, or in some cases, remotely run code.

 

Upon researching our product-line source code we have identified the legacy model DIR-685 as being affected. Please see below for patch update information
 

References

  

Stefan Viehbock :: Link :: Initially April 10, 2015

 

CERT :: VU#177092 :: Link :: Disclosed May 19, 2015

 

Description

 

Referencing : VU#177092

KCodes NetUSB is a Linux kernel module that provides USB over IP. It is used to provide USB device sharing on a home user network.

 

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') - CVE-2015-3036

According to the reporter, computer client data provided when connecting to the NetUSB server is not properly validated by the driver before processing, resulting in a buffer overflow that may lead to a denial of service or code execution. More information can be found in SEC Consult's advisory.
 

Recommendations

 

Check router device history for any unauthorised access.

 

All devices on your network should have log-in credentials and if your network has Wi-Fi, please make sure Wi-Fi encryption-keys are enabled. Also for devices that cannot notify the owner of a new software updates, check for updates from the devices manufacturer.

 

Immediately update to the fixed firmware referenced in the table below as they are made available. Please continue to monitor this page for further updates and disclosures.

 

D-Link recommends that your D-Link router remote network management feature be disabled (factory default is disabled) to mitigate a malicious remote user using this vulnerability to exploit your router.  If remote network management is disabled, a malicious user would require to be on the local network side of the router or have compromised another device on the network that could be used to attack the router.

 

D-Link recommends that all PCs (Window or Mac) be up-to-date and scanned for virus, bots, or other damaging software that could compromise the network they are connected.

 

Wi-Fi encryption reduces the risk to this vulnerability if the device Web-GUI is accessed over Wi-Fi. If Wi-Fi network was encrypted, the malicious user would also need to compromise the Wi-Fi encryption, or PC using the Web-GUI utility, in order to monitor the traffic and intercept the cookie. 

 

The default configuration of D-Link's routers is to provide simple installation, ease of usability, and offer widest interoperability. D-Link Europe reminds customers to configure their devices specifically to  and for security concerns within their network infrastructure. In General, D-Link Europe recommends disabling services not being used, changing/securing device log-in credentials, enabling Wi-Fi encryption, monitoring the routers log files, and access-lists for your devices so security risks for your entire network are minimised. 

Affected Product 

 

Security patch for your D-Link Devices

 

These firmware updates address the security vulnerabilities in affected D-Link devices. D-Link will update this continually and we strongly recommend all users to install the relevant updates.

 

As there are different hardware revisions on our products, please check this on your device before downloading the correct corresponding firmware update. The hardware revision information can usually be found on the product label on the underside of the product next to the serial number. Alternatively, they can also be found on the device web configuration.