OpenWrt distribution versions have been released 18.06.7 and 19.07.1, which fix vulnerability CVE-2020-7982 in the opkg package manager, which allowed for a MITM attack to replace the content of packages downloaded from the repository. Due to an error in the checksum verification code, an attacker could ignore the SHA-256 checksums from the package, thereby circumventing the integrity checking mechanisms for the downloaded ipk resources.
The issue has existed since February 2017, after code was added to ignore leading spaces before the checksum. Due to an error in skipping spaces, the pointer was not moved to the position in the string, causing the SHA-256 hexadecimal decoding loop to immediately return control with a checksum of zero length.
Because the opkg package manager ran as root, an attacker could modify the contents of the ipk package during a MITM attack while it was being downloaded from the repository during the execution of the "opkg install" command, allowing the attacker to execute their code with root privileges by adding their own handler scripts to the package that would be called upon installation. To exploit this vulnerability, the attacker would also need to substitute the package index (for example, downloaded from downloads.openwrt.org). The size of the modified package must match the original from the index.
In the new versions, another vulnerability in the libubox library, which can lead to a buffer overflow when processing specially formatted serialized binary data or JSON formatted data in the blobmsg_format_json function.
Source: linux.org.ru
