(0Day) ASUS TM-AC1900 httpd Stack Buffer Overflow Remote Code Execution Vulnerability

2015-09-02T00:00:00
ID ZDI-15-409
Type zdi
Reporter Elvis Collado - HP DVLabs
Modified 2015-11-09T00:00:00

Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the ASUS TM-1900. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP header parsing routine. The issue lies in the failure to check the size of header values. An attacker could leverage this vulnerability to execute code within the context of root.