the original cloud security

Lorex Security DVR Active-X Buffer Overflow

Lorex Security DVR Active-X Buffer Overflow
Posted Jan 10, 2014
Authored by Pedro Ribeiro

Lorex Security DVR systems suffers from an active-x related buffer overflow vulnerability.

tags | advisory, overflow, activex
advisories | CVE-2014-1201
MD5 | 40fc8627f548e7485d2fd7dc68e1edc7

Lorex Security DVR Active-X Buffer Overflow

Change Mirror Download
Hi,

I have discovered a buffer overflow vulnerability that allows remote code
execution in an ActiveX control bundled by a manufacturer of video
surveillance systems.
The company is Lorex Technologies, a major video surveillance manufacturer
that is very popular in the US and East Asia. Their affected product range
is the EDGE series, which has 16 products in it. I have confirmed that all
16 are vulnerable at this point in time. These security DVR's are remotely
accessible, and when you access it on a Windows computer with Internet
Explorer, they try to install the vulnerable ActiveX control INetViewX. The
Lorex manual[1] instructs the user to blindly accept the ActiveX control
install when prompted.
The full list of devices, as well as links to the firware download, can be
found in [2]. Their products offer remote video viewing capabilities, and
you can find some of them on Shodan[3].

The buffer overflow can be triggered by a really long string (10000+
characters) in the HTTP_PORT parameter. The instruction pointer can be very
easily controlled in XP by the characters 109 to 113 in the string. Please
refer to the PoC file lorex-testcase.html. You will see that the HTTP_PORT
parameter is composed of D's, apart from chars 109 to 113 which are four
A's. If you open this file in IE after installing the control, you will see
that IE will crash with an EIP of 0x41414141. Changing the four A's to any
other value will cause EIP to crash on that value.

The list below tells a better story about what is affected and how it can
be controlled:
Win XP SP3 with IE6 - Fully exploitable as described
Win XP SP3 with IE8 - Could not get it to crash (????)
Win 7 x64 with IE10 fully patched - Fully exploitable, though not as easy
as for XP (see analyze -v [4] and !exploitable [5] outputs)

To verify this vulnerability you can download and extract the firmware
using binwalk (http://code.google.com/p/binwalk/). To do so, please follow
the instructions in [6], and then install the ActiveX control in
INetViewProj1_02030330.cab.

I have contacted Lorex and they initially said they would fix it, but went
radio silent shortly afterwards.
17.11.2013 - Initial contact via support page
18.11.2013 - Email to sales, no response.
21.11.2013 - Second email to sales, received response by sales saying they
will forward it to technical support and get back to me.
04.12.2013 - Third email to sales saying that technical support never
contacted me back. No response.
08.01.2013 - MITRE assigns CVE-2014-1201 to this issue.
09.01.2013 - Public disclosure.

All references can be found at:
https://github.com/pedrib/PoC/lorexActivex/lorex-report.txt

Proof of concept:
https://github.com/pedrib/PoC/lorexActivex/lorex-testcase.html

Regards,
Pedro Ribeiro (pedrib@gmail.com)
Agile Information Security

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    6 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close