The Graveyard - Products No Longer Supported > DIR-850L

Firmware 1.20B03/2.20B03 Released - Security Fixes

(1/6) > >>

GreenBay42:
New firmware has been released for both revision A and B. This fixes several security exploits.

The ZIP file will contain 2 firmware files. Please read the instructions before upgrading the firmware. You must upgrade the 2 files in order and then reset the router back to factory default settings so make note of your settings before upgrading.

Rev A

Firmware -> ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-850L/REVA/DIR-850L_REVA_FIRMWARE_PATCH_v1.20B03.zip

Rev B

Firmware --> ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-850L/REVB/DIR-850L_REVB_FIRMWARE_PATCH_v2.20B03.zip


Release Notes:

Problems Resolved:
1. Fixed the security issues reported by Pierre Kim on Sept. 8th, 2017.

* Firmware Protection
* WAN && LAN - XSS exploit
(CVE-2017-14413, CVE-2017-14414, CVE-2017-14415, CVE-2017-14416)
* WAN - Weak Cloud protocol
(CVE-2017-14419, CVE-2017-14420)
* WAN && LAN - Stunnel private keys
(CVE-2017-14422)
* WAN && LAN - Nonce brute forcing for DNS configuration
(CVE-2017-14423)
* Local - Weak files permission and credentials stored in clear text
(CVE-2017-14424, CVE-2017-14425, CVE-2017-14426, CVE-2017-14427, CVE-2017-14428)

* LAN – DoS attack against some daemons
(CVE-2017-14430)

lescarlson:
"You must upgrade the 2 files in order and then reset the router back to factory default settings so make note of your settings before upgrading."

"so make note of your settings before upgrading."... Does this mean you can't use the routers save config feature?
"and then reset the router back to factory default"... Does this mean the reset must be done manually?

FurryNutz:
Please factory reset the router before sending the 1st update file. Then send the 2nd file. Factory reset once more after the 2nd file was processed by the router then set up from scratch. After router is set up, save the router config to a new file.

There is differences between your current version and this new one which the old config file may be incompatible and cause problems. So set up from scratch and then save a new file. Take notes or screen captures of your current router settings before starting the FW update process.

Use IE11 or FF browsers. Do not use Chrome!


--- Quote from: lescarlson on October 13, 2017, 05:34:51 PM ---"You must upgrade the 2 files in order and then reset the router back to factory default settings so make note of your settings before upgrading."

"so make note of your settings before upgrading."... Does this mean you can't use the routers save config feature?
"and then reset the router back to factory default"... Does this mean the reset must be done manually?

--- End quote ---

lescarlson:
Immediately after installing this 1.20 / 2.20 HW B security fix (both files according to instructions) the 850L lost internet connection momentarily and again once every 5 minutes. It would reconnect then lose its connection exactly 5 minutes later and so on and so on. Any stream occurring would halt and would have to be restarted again manually from the app or streaming device. I am connected to a DSL modem via a 'DHCP dynamic ip' connection. Before the 1.20 / 2.20 security firmware the router worked perfectly. Careful screen shots were taken prior to the update to reconfigure.

I have since set up the router using the currently assigned IP address as a 'Static' address. Doing this has completely solved the "5 minute disconnect" thing. This is all well and good except when my ISP provider changes my dynamic IP address (which happens irregularly about 2wice a month) the router will lose its connection and the newly  assigned address will have to be reconfigured as a static address in the 850L router again.

Has any one else experienced this? Is this some thing D-link is aware of?

FurryNutz:
Was a factory reset performed after the last file was process then set up from scratch and don't load a saved configuration from file?

What is the Mfr and model of the ISP modem?

* For DSL/PPPoE connections on the router, ensure that "Always ON" option is enabled.
* If the ISP modem has a built in router, it's best to bridge the modem. Having 2 routers on the same line can cause connection problems: Link>Double NAT and How NAT Works. Call the ISP and ask to see if the ISP modem can be bridged. To tell if the modem is bridged or not, look at the routers web page, Status/Device Info/Wan Section, if there is a 192.168.0.# address in the WAN IP address field, then the modem is not bridged. If the modem can't be bridged then see if the modem has a DMZ option and input the IP address the router gets from the modem and put that into the modems DMZ. Also check the routers DHCP IP address maybe conflicting with the ISP modems IP address of 192.168.0.1. Check to see if this is the same on the ISP modem, and if modem can't be bridged, change the DIR router to 192.168.1.1 or .0.254.
Example of a D-Link router configured for PPPoE with ISP Modem bridged: PPPoE Configuration on a Router

Also set the WAN port speed from Auto to 100Mb and test...



--- Quote from: lescarlson on October 29, 2017, 04:02:27 PM ---Immediately after installing this 1.20 / 2.20 HW B security fix (both files according to instructions) the 850L lost internet connection momentarily and again once every 5 minutes. It would reconnect then lose its connection exactly 5 minutes later and so on and so on. Any stream occurring would halt and would have to be restarted again manually from the app or streaming device. I am connected to a DSL modem via a 'DHCP dynamic ip' connection. Before the 1.20 / 2.20 security firmware the router worked perfectly. Careful screen shots were taken prior to the update to reconfigure.

I have since set up the router using the currently assigned IP address as a 'Static' address. Doing this has completely solved the "5 minute disconnect" thing. This is all well and good except when my ISP provider changes my dynamic IP address (which happens irregularly about 2wice a month) the router will lose its connection and the newly  assigned address will have to be reconfigured as a static address in the 850L router again.

Has any one else experienced this? Is this some thing D-link is aware of?

--- End quote ---

Navigation

[0] Message Index

[#] Next page