By Two severe, distantly exploitable flaws in Sony IPELA E Series Network Camera products could permit hackers to implement instructions or random code on distressed devices. The initial of the flaws is a command injection bug in the measurementBitrateExec utility of the IPELA E Series Network Camera pursued as CVE-2018-3937. These are network fronting devices practiced for observing and investigation.
The problem was exposed by Cory Duplantis and Claudio Bozzato of Cisco Talos, who describe that random orders could be performed via a particularly crafted GET appeal. A hacker observing to initiate the flaw could merely direct an HTTP appeal for that.
“While parsing the input measurement string, there isn’t a check on the server address (-c). In this manner, any string can be placed as the server address and will be executed via system. Knowing this, an attacker can execute arbitrary commands in the position of the server address,” the researchers explain.
The subsequent flaw is pursued as CVE-2018-3938 and distresses the 802dot1xclientcert.cgi utility of IPELA E Series Camera devices.
“A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST request to trigger this vulnerability,” Cisco says. The 802dot1xclientcert.cgi endpoint, the sanctuary investigators clarify, is “designed to handle everything related to certificate management for 802.1x.”
When data is customary, convinced authorizations are accomplished and the data is then straight imitative to a confined buffer via memcpy. But, since the strlen extent is not checked in contradiction of a harmless worth, a stack-based buffer excess happens and a hacker can exploit it to distantly implement orders on the device.
Both flaws were described to Sony previous month. Presenting a CVSS score of 9.1, both of these problem were identified in Sony IPELA E series G5 firmware 1.87.00. Sony announced an update previous week to state the security flaws.
