exploit the possibilities

AXIS Camera Control Buffer Overflow

AXIS Camera Control Buffer Overflow
Posted Jan 23, 2009
Authored by Alin Rad Pop | Site secunia.com

Secunia Research has discovered a vulnerability in AXIS Camera Control, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to a boundary error in the CamImage.CamImage.1 ActiveX control (AxisCamControl.ocx) and can be exploited to cause a heap-based buffer overflow by assigning an overly long string to the "image_pan_tilt" property. Successful exploitation allows execution of arbitrary code, but requires that the user is tricked into visiting and clicking a malicious web page. AXIS Camera Control version 2.40.0.0 is affected.

tags | advisory, web, overflow, arbitrary, activex
advisories | CVE-2008-5260
MD5 | ea1f58ca4dea9b020d62a810084a1a20

AXIS Camera Control Buffer Overflow

Change Mirror Download
====================================================================== 

Secunia Research 23/01/2009

- AXIS Camera Control "image_pan_tilt" Property Buffer Overflow -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

======================================================================
1) Affected Software

* AXIS Camera Control version 2.40.0.0

NOTE: Prior versions may also be affected.

======================================================================
2) Severity

Rating: Highly critical
Impact: System compromise
Where: Remote

======================================================================
3) Vendor's Description of Software

"AXIS Camera Control (ActiveX component) makes it possible to view
Motion JPEG video streams from an Axis Network Video product directly
in Microsoft Development Tools and Microsoft Internet Explorer."

Product Link:
http://www.axis.com/techsup/software/acc/index.htm

======================================================================
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in AXIS Camera
Control, which can be exploited by malicious people to compromise a
user's system.

The vulnerability is caused due to a boundary error in the
CamImage.CamImage.1 ActiveX control (AxisCamControl.ocx) and can be
exploited to cause a heap-based buffer overflow by assigning an overly
long string to the "image_pan_tilt" property.

Successful exploitation allows execution of arbitrary code, but
requires that the user is tricked into visiting and clicking a
malicious web page.

======================================================================
5) Solution

The vendor recommends removing the ActiveX control and using
AXIS Media Control as a replacement.

======================================================================
6) Time Table

09/01/2009 - Vendor notified.
09/01/2009 - Vendor response.
23/01/2009 - Public disclosure.

======================================================================
7) Credits

Discovered by Alin Rad Pop, Secunia Research.

======================================================================
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2008-5260 for the vulnerability.

======================================================================
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

======================================================================
10) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2008-58/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    12 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    16 Files
  • 22
    May 22nd
    3 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close