Details of VAR-200706-0390

ID

VAR-200706-0390

CVE

CVE-2007-3488

TITLE

Sony Network Camera SNC-P5 SonySncP5View.OCX ActiveX Control Buffer Overflow Vulnerability

Trust: 0.9

sources: BID: 24684 // CNNVD: CNNVD-200706-528

DESCRIPTION

Heap-based buffer overflow in the viewer ActiveX control in Sony Network Camera SNC-RZ25N before 1.30; SNC-P1 and SNC-P5 before 1.29; SNC-CS10 and SNC-CS11 before 1.06; SNC-DF40N and SNC-DF70N before 1.18; SNC-RZ50N and SNC-CS50N before 2.22; SNC-DF85N, SNC-DF80N, and SNC-DF50N before 1.12; and SNC-RX570N/W, SNC-RX570N/B, SNC-RX550N/W, SNC-RX550N/B, SNC-RX530N/W, and SNC-RX530N/B 3.00 and 2.x before 2.31; allows remote attackers to execute arbitrary code via a long first argument to the PrmSetNetworkParam method. The ActiveX Control for Sony SNC series network cameras is a software to monitor images over the network using a web browser. Failed exploit attempts likely result in denial-of-service conditions. ---------------------------------------------------------------------- Did you know? Our assessment and impact rating along with detailed information such as exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more about our commercial solutions: http://secunia.com/advisories/business_solutions/ Click here to trial our solutions: http://secunia.com/advisories/try_vi/ ---------------------------------------------------------------------- TITLE: Sony Network Camera ActiveX Control Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA33968 VERIFY ADVISORY: http://secunia.com/advisories/33968/ DESCRIPTION: A vulnerability has been reported in the Sony Network Camera ActiveX control, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an unspecified error and can be exploited to cause a buffer overflow. Successful exploitation may allow execution of arbitrary code. Please see vendor advisory for a list of products and firmware versions that include the affected ActiveX control. SOLUTION: Update to a fixed version. See vendor advisory for more details. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: Sony: http://www.sony.jp/professional/News/info/pb20090223.html OTHER REFERENCES: JVN: http://jvn.jp/jp/JVN16767117/index.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.34

sources: NVD: CVE-2007-3488 // JVNDB: JVNDB-2009-000012 // BID: 33876 // BID: 24684 // VULHUB: VHN-26850 // PACKETSTORM: 75135

AFFECTED PRODUCTS

vendor:	sony	model:	network camera snc-p5	scope:	eq	version:	1.0	Trust: 2.2
vendor:	sony	model:	snc-cs10	scope:	eq	version:	prior to 1.06	Trust: 0.8
vendor:	sony	model:	snc-cs11	scope:	eq	version:	prior to 1.06	Trust: 0.8
vendor:	sony	model:	snc-cs50n	scope:	eq	version:	prior to 2.22	Trust: 0.8
vendor:	sony	model:	snc-cs50p	scope:	eq	version:	prior to 2.22	Trust: 0.8
vendor:	sony	model:	snc-df40n	scope:	eq	version:	prior to 1.18	Trust: 0.8
vendor:	sony	model:	snc-df40p	scope:	eq	version:	prior to 1.18	Trust: 0.8
vendor:	sony	model:	snc-df50n	scope:	eq	version:	prior to 1.12	Trust: 0.8
vendor:	sony	model:	snc-df50p	scope:	eq	version:	prior to 1.12	Trust: 0.8
vendor:	sony	model:	snc-df70n	scope:	eq	version:	prior to 1.18	Trust: 0.8
vendor:	sony	model:	snc-df70p	scope:	eq	version:	prior to 1.18	Trust: 0.8
vendor:	sony	model:	snc-df80n	scope:	eq	version:	prior to 1.12	Trust: 0.8
vendor:	sony	model:	snc-df80p	scope:	eq	version:	prior to 1.12	Trust: 0.8
vendor:	sony	model:	snc-df85n	scope:	eq	version:	prior to 1.12	Trust: 0.8
vendor:	sony	model:	snc-df85p	scope:	eq	version:	prior to 1.12	Trust: 0.8
vendor:	sony	model:	snc-p1	scope:	eq	version:	prior to 1.29	Trust: 0.8
vendor:	sony	model:	snc-p5	scope:	eq	version:	prior to 1.29	Trust: 0.8
vendor:	sony	model:	snc-rx530n	scope:	eq	version:	(b) 3.00 or prior to 2.31	Trust: 0.8
vendor:	sony	model:	snc-rx530n	scope:	eq	version:	(w) 3.00 or prior to 2.31	Trust: 0.8
vendor:	sony	model:	snc-rx530p	scope:	eq	version:	3.00 or prior to 2.31	Trust: 0.8
vendor:	sony	model:	snc-rx550n	scope:	eq	version:	(b) 3.00 or prior to 2.31	Trust: 0.8
vendor:	sony	model:	snc-rx550n	scope:	eq	version:	(w) 3.00 or prior to 2.31	Trust: 0.8
vendor:	sony	model:	snc-rx550p	scope:	eq	version:	3.00 or prior to 2.31	Trust: 0.8
vendor:	sony	model:	snc-rx570n	scope:	eq	version:	(b) 3.00 or prior to 2.31	Trust: 0.8
vendor:	sony	model:	snc-rx570n	scope:	eq	version:	(w) 3.00 or prior to 2.31	Trust: 0.8
vendor:	sony	model:	snc-rx570p	scope:	eq	version:	3.00 or prior to 2.31	Trust: 0.8
vendor:	sony	model:	snc-rz25n	scope:	eq	version:	prior to 1.30	Trust: 0.8
vendor:	sony	model:	snc-rz25p	scope:	eq	version:	prior to 1.30	Trust: 0.8
vendor:	sony	model:	snc-rz50n	scope:	eq	version:	prior to 2.22	Trust: 0.8
vendor:	sony	model:	snc-rz50p	scope:	eq	version:	prior to 2.22	Trust: 0.8
vendor:	sony	model:	network camera snc-rz50n	scope:	eq	version:	2.21	Trust: 0.3
vendor:	sony	model:	network camera snc-rz25n	scope:	eq	version:	1.29	Trust: 0.3
vendor:	sony	model:	network camera snc-rx570n/w	scope:	eq	version:	3.0	Trust: 0.3
vendor:	sony	model:	network camera snc-rx570n/w	scope:	eq	version:	2.30	Trust: 0.3
vendor:	sony	model:	network camera snc-rx570n/b	scope:	eq	version:	3.0	Trust: 0.3
vendor:	sony	model:	network camera snc-rx570n/b	scope:	eq	version:	2.30	Trust: 0.3
vendor:	sony	model:	network camera snc-rx550n/w	scope:	eq	version:	3.0	Trust: 0.3
vendor:	sony	model:	network camera snc-rx550n/w	scope:	eq	version:	2.30	Trust: 0.3
vendor:	sony	model:	network camera snc-rx550n/b	scope:	eq	version:	3.0	Trust: 0.3
vendor:	sony	model:	network camera snc-rx550n/b	scope:	eq	version:	2.30	Trust: 0.3
vendor:	sony	model:	network camera snc-rx530n/w	scope:	eq	version:	3.0	Trust: 0.3
vendor:	sony	model:	network camera snc-rx530n/w	scope:	eq	version:	2.30	Trust: 0.3
vendor:	sony	model:	network camera snc-rx530n/b	scope:	eq	version:	3.0	Trust: 0.3
vendor:	sony	model:	network camera snc-rx530n/b	scope:	eq	version:	2.30	Trust: 0.3
vendor:	sony	model:	network camera snc-p5	scope:	eq	version:	1.28	Trust: 0.3
vendor:	sony	model:	network camera snc-p1	scope:	eq	version:	1.28	Trust: 0.3
vendor:	sony	model:	network camera snc-df85n	scope:	eq	version:	1.11	Trust: 0.3
vendor:	sony	model:	network camera snc-df80n	scope:	eq	version:	1.11	Trust: 0.3
vendor:	sony	model:	network camera snc-df70n	scope:	eq	version:	1.17	Trust: 0.3
vendor:	sony	model:	network camera snc-df50n	scope:	eq	version:	1.11	Trust: 0.3
vendor:	sony	model:	network camera snc-df40n	scope:	eq	version:	1.17	Trust: 0.3
vendor:	sony	model:	network camera snc-cs50n	scope:	eq	version:	2.21	Trust: 0.3
vendor:	sony	model:	network camera snc-cs11	scope:	eq	version:	1.05	Trust: 0.3
vendor:	sony	model:	network camera snc-cs10	scope:	eq	version:	1.05	Trust: 0.3
vendor:	sony	model:	network camera snc-rz50n	scope:	ne	version:	2.22	Trust: 0.3
vendor:	sony	model:	network camera snc-rz25n	scope:	ne	version:	1.30	Trust: 0.3
vendor:	sony	model:	network camera snc-rx570n/w	scope:	ne	version:	3.01	Trust: 0.3
vendor:	sony	model:	network camera snc-rx570n/w	scope:	ne	version:	2.31	Trust: 0.3
vendor:	sony	model:	network camera snc-rx570n/b	scope:	ne	version:	3.01	Trust: 0.3
vendor:	sony	model:	network camera snc-rx570n/b	scope:	ne	version:	2.31	Trust: 0.3
vendor:	sony	model:	network camera snc-rx550n/w	scope:	ne	version:	3.01	Trust: 0.3
vendor:	sony	model:	network camera snc-rx550n/w	scope:	ne	version:	2.31	Trust: 0.3
vendor:	sony	model:	network camera snc-rx550n/b	scope:	ne	version:	3.01	Trust: 0.3
vendor:	sony	model:	network camera snc-rx550n/b	scope:	ne	version:	2.31	Trust: 0.3
vendor:	sony	model:	network camera snc-rx530n/w	scope:	ne	version:	3.01	Trust: 0.3
vendor:	sony	model:	network camera snc-rx530n/w	scope:	ne	version:	2.31	Trust: 0.3
vendor:	sony	model:	network camera snc-rx530n/b	scope:	ne	version:	3.01	Trust: 0.3
vendor:	sony	model:	network camera snc-rx530n/b	scope:	ne	version:	2.31	Trust: 0.3
vendor:	sony	model:	network camera snc-p5	scope:	ne	version:	1.29	Trust: 0.3
vendor:	sony	model:	network camera snc-p1	scope:	ne	version:	1.29	Trust: 0.3
vendor:	sony	model:	network camera snc-df85n	scope:	ne	version:	1.12	Trust: 0.3
vendor:	sony	model:	network camera snc-df80n	scope:	ne	version:	1.12	Trust: 0.3
vendor:	sony	model:	network camera snc-df70n	scope:	ne	version:	1.18	Trust: 0.3
vendor:	sony	model:	network camera snc-df50n	scope:	ne	version:	1.12	Trust: 0.3
vendor:	sony	model:	network camera snc-df40n	scope:	ne	version:	1.18	Trust: 0.3
vendor:	sony	model:	network camera snc-cs50n	scope:	ne	version:	2.22	Trust: 0.3
vendor:	sony	model:	network camera snc-cs11	scope:	ne	version:	1.06	Trust: 0.3
vendor:	sony	model:	network camera snc-cs10	scope:	ne	version:	1.06	Trust: 0.3

sources: BID: 33876 // BID: 24684 // JVNDB: JVNDB-2009-000012 // CNNVD: CNNVD-200706-528 // NVD: CVE-2007-3488

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2007-3488
value:	HIGH
Trust: 1.0
IPA:	JVNDB-2009-000012
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-200706-528
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-26850
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2007-3488
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
IPA:	JVNDB-2009-000012
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-26850
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-26850 // JVNDB: JVNDB-2009-000012 // CNNVD: CNNVD-200706-528 // NVD: CVE-2007-3488

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	CWE-119	Trust: 0.8

sources: JVNDB: JVNDB-2009-000012 // NVD: CVE-2007-3488

THREAT TYPE

network

Trust: 0.6

sources: BID: 33876 // BID: 24684

TYPE

Boundary Condition Error

Trust: 0.6

sources: BID: 33876 // BID: 24684

CONFIGURATIONS

sources: JVNDB: JVNDB-2009-000012

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-26850

PATCH

title:

List of Affected Sony Network Cameras

url:

http://pro.sony.com/bbsc/ssr/cat-securitycameras/resource.downloads.bbsccms-assets-cat-camsec-downloads-AffectedNetworkCameras.shtml

Trust: 0.8

sources: JVNDB: JVNDB-2009-000012

EXTERNAL IDS

db:	JVNDB	id:	JVNDB-2009-000012	Trust: 3.3
db:	JVN	id:	JVN16767117	Trust: 2.9
db:	NVD	id:	CVE-2007-3488	Trust: 2.8
db:	BID	id:	24684	Trust: 2.8
db:	OSVDB	id:	39479	Trust: 2.5
db:	EXPLOIT-DB	id:	4120	Trust: 1.7
db:	XF	id:	35133	Trust: 1.4
db:	CNNVD	id:	CNNVD-200706-528	Trust: 0.7
db:	MILW0RM	id:	4120	Trust: 0.6
db:	XF	id:	5	Trust: 0.6
db:	JVN	id:	JVN#16767117	Trust: 0.6
db:	BID	id:	33876	Trust: 0.3
db:	SECUNIA	id:	33968	Trust: 0.2
db:	SEEBUG	id:	SSVID-64771	Trust: 0.1
db:	VULHUB	id:	VHN-26850	Trust: 0.1
db:	PACKETSTORM	id:	75135	Trust: 0.1

sources: VULHUB: VHN-26850 // BID: 33876 // BID: 24684 // JVNDB: JVNDB-2009-000012 // PACKETSTORM: 75135 // CNNVD: CNNVD-200706-528 // NVD: CVE-2007-3488

REFERENCES

url:	http://www.securityfocus.com/bid/24684	Trust: 2.5
url:	http://jvn.jp/en/jp/jvn16767117/index.html	Trust: 2.5
url:	http://jvndb.jvn.jp/ja/contents/2009/jvndb-2009-000012.html	Trust: 2.5
url:	http://osvdb.org/39479	Trust: 2.5
url:	http://jvn.jp/en/jp/jvn16767117/041520/index.html	Trust: 1.7
url:	http://pro.sony.com/bbsc/ssr/cat-securitycameras/resource.downloads.bbsccms-assets-cat-camsec-downloads-affectednetworkcameras.shtml	Trust: 1.7
url:	http://xforce.iss.net/xforce/xfdb/35133	Trust: 1.4
url:	https://www.exploit-db.com/exploits/4120	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/35133	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-3488	Trust: 0.8
url:	http://www.ipa.go.jp/security/english/vuln/200902_sonysnc_en.html	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-3488	Trust: 0.8
url:	http://www.sony.com	Trust: 0.6
url:	http://www.milw0rm.com/exploits/4120	Trust: 0.6
url:	http://jvn.jp/jp/jvn16767117/index.html	Trust: 0.4
url:	http://www.sony.jp/professional/news/info/pb20090223.html	Trust: 0.4
url:	http://support.microsoft.com/kb/240797	Trust: 0.3
url:	http://bssc.sel.sony.com/broadcastandbusiness/displaymodel?id=79540	Trust: 0.3
url:	http://secunia.com/advisories/33968/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/advisories/business_solutions/	Trust: 0.1
url:	http://secunia.com/advisories/try_vi/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: VULHUB: VHN-26850 // BID: 33876 // BID: 24684 // JVNDB: JVNDB-2009-000012 // PACKETSTORM: 75135 // CNNVD: CNNVD-200706-528 // NVD: CVE-2007-3488

CREDITS

str0ke is credited with the discovery of this issue.

Trust: 0.9

sources: BID: 24684 // CNNVD: CNNVD-200706-528

SOURCES

db:	VULHUB	id:	VHN-26850
db:	BID	id:	33876
db:	BID	id:	24684
db:	JVNDB	id:	JVNDB-2009-000012
db:	PACKETSTORM	id:	75135
db:	CNNVD	id:	CNNVD-200706-528
db:	NVD	id:	CVE-2007-3488

LAST UPDATE DATE

2025-04-10T22:22:00.122000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-26850	date:	2017-09-29T00:00:00
db:	BID	id:	33876	date:	2009-02-24T20:27:00
db:	BID	id:	24684	date:	2015-05-07T17:37:00
db:	JVNDB	id:	JVNDB-2009-000012	date:	2009-03-09T00:00:00
db:	CNNVD	id:	CNNVD-200706-528	date:	2009-03-20T00:00:00
db:	NVD	id:	CVE-2007-3488	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-26850	date:	2007-06-29T00:00:00
db:	BID	id:	33876	date:	2009-02-24T00:00:00
db:	BID	id:	24684	date:	2007-06-27T00:00:00
db:	JVNDB	id:	JVNDB-2009-000012	date:	2009-03-09T00:00:00
db:	PACKETSTORM	id:	75135	date:	2009-02-24T15:54:35
db:	CNNVD	id:	CNNVD-200706-528	date:	2007-06-29T00:00:00
db:	NVD	id:	CVE-2007-3488	date:	2007-06-29T18:30:00