This loop finishes when the size to copy is equal to zero. Once that is done, the next byte of the source buffer is read and used as the new size. The function then copies that amount of bytes into the destination buffer. The first byte of the source buffer is read and used as the size for the copy operation. As an example reference, this function is located at address 0x08054607 on the x86 SMB binary version 6.40.5. The overflow takes place in the function in charge of parsing NetBIOS names, which receives two stack allocated buffers as parameters. Technical Description / Proof of Concept Code The publication of this advisory was coordinated by Leandro Cuozzo from Core Advisories Team.ħ. This vulnerability was discovered and researched by Juan Caillava and Maximiliano Vidal from Core Security Consulting Services.

The workaround suggested by MikroTik in case it is not possible to install an update consists of disabling the SMB service.MikroTik released version 6.41.3 of RouterOS that fixes the reported issue.Vendor Information, Solutions and Workarounds All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27ĥ.The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. RouterOS is MikroTik's stand-alone operating system based on Linux v3.3.5 kernel.Ī buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. MikroTik now provides hardware and software for Internet connectivity in most of the countries around the world. MikroTik is a Latvian company which was founded in 1996 to develop routers and wireless ISP systems.

Vulnerability InformationĬlass: Stack-based Buffer Overflow Title: MikroTik RouterOS SMB Buffer Overflow

How to protect your mikrotik routeros