[FD] MikroTik RouterBoard v6.38.5 - Denial of Service Vulnerability

Document Title: =============== MikroTik RouterBoard v6.38.5 - Denial of Service Vulnerability References (Source): ==================== http://ift.tt/2pu7NYv Release Date: ============= 2017-05-09 Vulnerability Laboratory ID (VL-ID): ==================================== 2064 Common Vulnerability Scoring System: ==================================== 3.8 Vulnerability Class: ==================== Denial of Service Product & Service Introduction: =============================== The company manufactures a series of integrated circuit boards, marketed under the name RouterBOARD, as well as accessory components which implement a complete hardware operating platform for RouterOS. (Copy of the Homepage: http://ift.tt/1Hq95J4 ) Abstract Advisory Information: ============================== An independent researcher discovered a Denial of Service Vulnerability for MikroTik RouterBoard V-6.38.5. A local attacker is able to crash the software and all bound running processes. Vulnerability Disclosure Timeline: ================================== 2017-05-09: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP packets on port 500 (used for L2TP over IPsec), preventing the affected router from accepting new connections; all devices will be disconnected from the router and all logs removed automatically. Proof of Concept (PoC): ======================= The denial of service vulnerability can be exploited by remote attackers without user account or user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. hping3 --udp -p 6000 --destport 500 --flood [router's IP]

Source: Gmail -> IFTTT-> Blogger