D-Link DWR-M960 Stack-Based Buffer Overflow Vulnerability in QoS Configuration

A stack-based buffer overflow vulnerability has been identified in the D-Link DWR-M960 router, specifically in the QoS configuration endpoint '/boafrm/formIpQoS' on firmware version 1.01.07. The vulnerability arises in the function 'sub_427D74', where the 'submit-url' parameter is processed without proper length validation. This oversight allows remote attackers to send oversized 'submit-url' values, leading to memory corruption that could cause a denial-of-service condition or potentially allow arbitrary code execution.

Impact

Exploitation of this vulnerability can cause the web server to crash or the device to reboot unexpectedly. Additionally, by carefully crafting the input, an attacker could overwrite function pointers or other control structures in memory to execute arbitrary code with elevated privileges.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/boafrm/formIpQoS' with the 'save_apply' parameter and an oversized 'submit-url' value. This can be done using a tool like Burp Suite to intercept and modify the request.