Auerswald USB Device Driver Buffer Overflow Vulnerability

vendor:

USB Device Driver

by:

SecurityFocus

7.8

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: USB Device Driver

Affected Version From: Linux kernel 2.6.26

Affected Version To: Prior versions

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2009

Auerswald USB Device Driver Buffer Overflow Vulnerability

The Auerswald USB Device Driver for the Linux kernel is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers can exploit this issue to execute arbitrary code with superuser privileges, facilitating the complete compromise of affected computers. Failed exploit attempts will likely crash the kernel, denying service to legitimate users.

Mitigation:

Upgrade to the latest version of the Auerswald USB Device Driver for the Linux kernel.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/48687/info

The Auerswald USB Device Driver for the Linux kernel is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with superuser privileges, facilitating the complete compromise of affected computers. Failed exploit attempts will likely crash the kernel, denying service to legitimate users.

Linux kernel 2.6.26 is vulnerable; prior versions may also be affected. 

0xbf, 0x09, /*  u16 idVendor; */ 
0xc0, 0x00, /*  u16 idProduct; */ 
0x10, 0x42, /*  u16 bcdDevice */ 

case 1: 
      /* serial number */ 
      ret = set_usb_string(data, ��); 
          break; 
      case 2: 
          ret = set_usb_string(data,�AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�);