#ACTION STRINGS BUG SOFTWARE#
#ACTION STRINGS BUG CODE#

#ACTION STRINGS BUG CODE#

With this new knowledge,В we developedВ aВ vulnerability detection ruleВ for IoT Inspector,В and uncovered multiple affected vendors and manufacturers in our dataset.Д«roadcomВ didВ notВ revealВ the exact versions of their SDK thatВ areВ affected by theseВ flaws to us, soВ we canВ onlyВ provide some guesstimates based on diffing Broadcom source code leaked inВ GitHubВ public repositories.В Furthermore, weВ are unableВ toВ provide generic CVE identifiers for these issues,В asВ Broadcom never issued one and vendors such as DD-WRT or Cisco started issuing their own.В However, we did try our best to untangle some pretty messy supply chains. However, none of the previous publications tiedВ the vulnerabilitiesВ to the actual producer of that code: Broadcom. When documenting these flaws, weВ noticedВ that some of these vulnerabilities were previouslyВ disclosedВ and documented already. a heap buffer overflow via UPnPВ PortmapAddВ calls.a stack buffer overflow via SSDP M-SEARCH packets.ThisВ binary was named bcmupnp ,В andВ in the reversing process weВ discoveredВ two obvious flaws: In the process,В weВ also investigatedВ a Broadcom binary implementing a UPnP serviceВ that we foundВ in aВ 4G/LTE router manufacturedВ by aВ ChineseВ vendor.

TheВ filenames of theseВ binariesВ usually start with bcmВ (e.g., bcm_atmctl, bcmcastctl, bcm_flasher, вЂ¦).

#ACTION STRINGS BUG SOFTWARE#

In the continuous quest toВ extend our software composition analysis, we were exploringВ rules for Broadcom binaries that weВ frequentlyВ find inВ connected devicesВ by a variety of manufacturers. In an effort to making IoT secure, you can verify if you are affected by the issues reported in this blog post, free of charge. Using IoT Inspector, this and many other supply chain issues can be identified automatically.

This further demonstrates the crucial need for supply chain security validation, such as secure development lifecycles and source code reviews on the supplierвЂ™s end, and third-party source code review on the device vendorвЂ™s end. We also linked one of these vulnerabilities to a security advisory released jointly by DD-WRT and SSD-Disclosure in early 2021. This led to the disclosure of security vulnerabilities such as CVE-2021-34730 (an unauthenticated remote code execution as root affecting Cisco RV110/RV130/RV215, which turned a forever-day). While we found indications that Broadcom patched these vulnerabilities as early as 2011, we discovered them to still be affecting devices released years later by major vendors such as Cisco, DD-WRT, or Linksys. We identified multiple security vulnerabilities affecting the UPnP implementation of BroadcomвЂ™s SDK when developing detection rules for Broadcom binaries.

Action strings bug