NETGEAR Routers and CVE-2016-582384 security vulnerability

I am a bit concerned about this recent article: http://www.zdnet.com/article/two-netgear-routers-are-vulnerable-to-trivial-to-remote-hack/ https://www.kb.cert.org/vuls/id/582384 Details: Overview Net...

backdoor

Firmware

injection

R7000

Security

vunerable

mdgm-ntgr
Dec 11, 2016

NETGEAR is aware of the security issue #582384 affecting R6250, R6400, R6700, R6900, R7000, R7100LG, R7300DST, R7900, R8000, D6220, D6400 routers. Stay updated here: http://kb.netgear.com/000036386/CVE-2016-582384

We now have beta firmware containing fixes for some affected models.

We're working hard on fixes for the other affected models and will update the security ticket above soon.

**** UPDATE from NETGEAR - Added by ChristineT on 12/15/16 at 10:30 AM PST ****

To our NETGEAR Community, we sincerely apologize for any complications you may have encountered due to the recently publicized vulnerability, referred to as VU 582384. We initially became aware of this vulnerability last Friday when CERT emailed us, and because we had no record of a prior report, we began our standard process of validation prior to making any public statements.

Once it had been disclosed that the first notification actually occurred in August, we conducted a search and confirmed this was the case. Admittedly, this was an oversight on our part. While no security reporting system is perfect, we aim to do better, and are evaluating how to improve our response process.

NETGEAR has created a channel for security researchers and other members of the public to contact us regarding potential security issues affecting NETGEAR products (security@netgear.com), which is publicly disclosed from the NETGEAR Product Security Advisory page. We receive numerous emails through this channel, the overwhelming majority of which, on review, do not raise product security issues. When we do recognize that there is a security risk to our customers, we work diligently to address them in a timely manner, as we have done in this case since learning about it last Friday.

Security Advisory for VU 582384 knowledgebase article.

NETGEAR Product Security Advisory page.

hggomes
Tutor
Feb 01, 2017
I'm not really interested on other projects GPLs, but on the original/native Netgear GPL code, which was always shared on their product/GPL page.
StephenB
Guru - Experienced User
Feb 01, 2017
IrvSp wrote:

Better off asking in https://www.myopenrouter.com/ as that is where Open Source is handled.

I don't think you can get the GPL links for Netgear firmware there - at least I am only seeing dd-wrt and similar stuff.

There's a kb article which should contain the links the OP is asking for, but which is now blank. ElaineM is looking into it.
hggomes
Tutor
Feb 01, 2017
Let's wait for them to fix the problem/GPL page.
IrvSp
Master
Feb 01, 2017
StephenB wrote:
IrvSp wrote:
Better off asking in https://www.myopenrouter.com/ as that is where Open Source is handled.

I don't think you can get the GPL links for Netgear firmware there - at least I am only seeing dd-wrt and similar stuff.

There's a kb article which should contain the links the OP is asking for, but which is now blank. ElaineM is looking into it.
Knew that, that is why I suggested that Hugo asks there. Obviously some of the developers might know where the GPL source code might be. I did find R7000's F/W source code with a Google search but it was V1.05, not of much value. That is at https://github.com/hajuuk/R7000, but just not I dug a little deeper on that page and there is a LINK to http://kb.netgear.com/app/answers/detail/a_id/2649/~/netgear-open-source-code-for-programmers-(gpl) and THAT IS WHERE all the version links are for many different devices. Just what he needs.
StephenB
Guru - Experienced User
Feb 01, 2017
IrvSp wrote:
...there is a LINK to http://kb.netgear.com/app/answers/detail/a_id/2649/~/netgear-open-source-code-for-programmers-(gpl) and THAT IS WHERE all the version links are for many different devices. Just what he needs

Exactly so.

Earlier in the day that displayed as a blank page. I PM'd ElaineM when I discovered that, and it looks like she was able to get it straightened out.
hggomes
Tutor
Feb 01, 2017
Fixed now:

http://kb.netgear.com/2649/NETGEAR-Open-Source-Code-for-Programmers-GPL?cid=wmt_netgear_organic
hggomes
Tutor
Feb 01, 2017
Out of curiosity I have downloaded latest R7000 1.0.7.6 FW version and GPL (released on 15 DEC 16) to confirm the closed thread was really fixed / got OpenSSL updated and I got astonished on how https://community.netgear.com/t5/General-WiFi-Routers/Netgear-routers-found-to-have-critical-vulnerabilities-within/td-p/1085599 case was closed / fixed, it seems nothing at all changed on the FW regarding OpenSSL old versions:

R7000 Firmware Version 1.0.7.6 - Released on 15 December 2016

OpenSSL 0.9.7f [22 Mar 2005] (source code) - 11 years and 10 months.
Location:
/ap/gpl/openssl
/ap/gpl/transmission/openssl

OpenSSL 0.9.8e [23 Feb 2007] (source code) - 9 years and 11 months.
Location:
/ap/gpl/timemachine/openssl-0.9.8e/

OpenSSL 1.0.0g [18 Jan 2012] (binary file libcrypto.so.1.0.0) - 5 years.
Location:
/src/router/arm-uclibc/target/lib

For reference on OpenSSL vulnerabilities:
https://www.openssl.org/news/vulnerabilities.html

All OpenSSL versions / branches used by Netgear FWs are EOL now / deprecated / no support anymore, which seems not to be a problem to Netgear DEV team, this issue was considered fixed by them not sure based on what changes.

So once again this was initially reported on May 16 and still not fixed, almost 1 year now, this seems a lost case to me like many others...

IrvSp Does it ring a/any bell now?
IrvSp
Master
Feb 01, 2017
You had another THREAD on this and were told what parts of it were being used. See https://community.netgear.com/t5/General-WiFi-Routers/Netgear-routers-found-to-have-critical-vulnerabilities-within/td-p/1085599 and use that one if you are unhappy with the results.

============
NETGEAR uses OpenSSL version 1.0.0 for all the router functions that require secure transportation (such as remote https and OpenVPN), we only use OpenSSL 0.9x for “libcrypto” functions in the Time Machine (taking backup from Apple Macs to USB HDD connected to the router) software package not for transportation.
============

If you think that is wrong, reply back in THAT thread.

You were also directed to this, http://kb.netgear.com/000036386/CVE-2016-582384, as well and it says it is corrected.

I assume you do not agree, CALL SUPPORT...
hggomes
Tutor
Feb 01, 2017
In case you haven't noticed that thread was closed, so I or anyone else is NOT able to reply to it, making your suggestion invalid. :-)

Their reply on this issue is non-sense anyway, beside 1.0.0 also is being used 0.9.7 and 0.9.8 which are all EOL / Deprecated / Not supported anymore versions, so it doesn't really matter if it's 1.0.0 or 0.9.7/8. they are all non-secure versions FYI.
IrvSp
Master
Feb 01, 2017
hggomes wrote:
In case you haven't noticed that thread was closed, so I or anyone else is NOT able to reply to it, making your suggestion invalid. :-)

Their reply on this issue is non-sense anyway, beside 1.0.0 also is being used 0.9.7 and 0.9.8 which are all EOL / Deprecated / Not supported anymore versions, so it doesn't really matter if it's 1.0.0 or 0.9.7/8. they are all non-secure versions FYI.
Didn't realize it was closed, so start a NEW one... don't hijack others.

Please put all you want to say before pressing the POST button. I read my email copy and I'm seeing many that appear close to the same from you. It is a waste of time reading them. Even then, as I reply to one you seem to be changing it too. PLEASE STOP posting like that.

EOL just means it will NOT be updated. One can STILL use it though. Did you know that XP and even Win95 is still in use? They I assume are using 3 different versions for different tasks, NONE of which exposes the firmware to an exploit it would seem according to NG. You have different proof, post it to them in a DIFFERENT thread please and STOP editing the ones you did post. I've seen 3 popups that you are replying to ones here as I enter this. Never see a new one though so it is an OLD one I've already read.
hggomes
Tutor
Feb 01, 2017
Unfortunatelly like I previously explained it's due to "Edit Reply" button use, so we should blame this forum software, it doesn't make too much sense to me a user not being able to edit the text.

I have really enjoyed your EOL explanation, maybe I'll give it a try on Windows 95, thank you. :-)
IrvSp
Master
Feb 01, 2017
hggomes wrote:
Unfortunatelly like I previously explained it's due to "Edit Reply" button use, so we should blame this forum software, it doesn't make too much sense to me a user not being able to edit the text.

I have really enjoyed your EOL explanation, maybe I'll give it a try on Windows 95, thank you. :-)
Most people DO NOT NEED to edit their posts. They USE PREVIEW and read what would be posted and if they want to make a change switch back to RICH TEXT or HTML, make the changes and when DONE, then press POST. Try it some time, you might like it.

Yes, EOL doesn't mean it will not work... functions used do...

I'm done with you... now I know why that thread was probably closed...

Forum Discussion

NETGEAR Routers and CVE-2016-582384 security vulnerability