Sign-up

ID

VAR-201207-0320


CVE

CVE-2012-0284


TITLE

Cisco Linksys PlayerPT ActiveX Stack-based buffer overflow vulnerability in Control

Trust: 0.8

sources: JVNDB: JVNDB-2012-003237

DESCRIPTION

Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote attackers to execute arbitrary code via a long URL in the first argument (aka the sURL argument). Cisco Linksys PlayerPT ActiveX Control is prone to a buffer-overflow vulnerability because the application fails to adequately check boundaries on user-supplied input. An attacker can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions. Cisco Linksys PlayerPT 1.0.0.15 is vulnerable; other versions may also be affected. ====================================================================== 2) Severity Rating: Highly critical Impact: System compromise Where: Remote ====================================================================== 3) Description of Vulnerability Secunia Research has discovered a vulnerability in Cisco Linksys PlayerPT ActiveX Control, which can be exploited by malicious people to compromise a user's system. The ActiveX control is marked safe-for-scripting and one of the provided methods is: "SetSource()", which is used to set the source of the footage to view. The method accepts five string arguments where the first ("sURL") is the URL to the footage. When a web page instantiates the ActiveX control and invokes the "SetSource()" method, the function in PlayerPT.ocx responsible for handling this method is called. The function performs various checks on the supplied arguments including a check to determine if the "sFrameType" string (2nd argument) is set to "mpeg". If so, the function searches for and strips "img/video.asf" from the provided URL in the "sURL" argument; if not, "img/mjpeg.cgi" is used. The URL is stored to a CString object and URLs to various resources are crafted based on the base URL including an URL to the "img/query.cgi" resource. Later, this URL is copied into a 256 byte stack buffer via a call to sprintf() without performing any size checks. This can be exploited to cause a stack-based buffer overflow via an overly long, specially crafted URL. Successful exploitation allows execution of arbitrary code. ====================================================================== 4) Solution According to the vendor, the ActiveX control is bundled only with products considered EOL and, therefore, itself considered EOL. The vendor is currently working on getting the kill-bit set. As a workaround, set the kill-bit for the following CLSID: * {9E065E4A-BD9D-4547-8F90-985DC62A5591} ====================================================================== 5) Time Table 23/03/2012 - Vulnerability discovered while analysing public report of similar vulnerability (SA48543#1). 23/03/2012 - Vendor notified. 02/04/2012 - Vendor response (WVC200 product bundling the ActiveX control has become EOL). 03/04/2012 - Vendor informed that ActiveX control should have kill-bit set if considered EOL and asked to confirm that no currently supported products bundle it. 13/04/2012 - Status update requested. 15/04/2012 - Vendor response (currently checking which products bundle the ActiveX control and looking into setting kill-bit). 21/06/2012 - Status update requested. 13/07/2012 - Status update requested. 13/07/2012 - Vendor response (determined that no supported products bundle the vulnerable ActiveX control and looking into setting kill-bit). 17/07/2012 - Public disclosure. ====================================================================== 6) Credits Discovered by Carsten Eiram, Secunia Research. ====================================================================== 7) References The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2012-0284 for the vulnerability. ====================================================================== 8) About Secunia Secunia offers vulnerability management solutions to corporate customers with verified and reliable vulnerability intelligence relevant to their specific system configuration: http://secunia.com/advisories/business_solutions/ Secunia also provides a publicly accessible and comprehensive advisory database as a service to the security community and private individuals, who are interested in or concerned about IT-security. http://secunia.com/advisories/ Secunia believes that it is important to support the community and to do active vulnerability research in order to aid improving the security and reliability of software in general: http://secunia.com/secunia_research/ Secunia regularly hires new skilled team members. Check the URL below to see currently vacant positions: http://secunia.com/corporate/jobs/ Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/advisories/mailing_lists/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2012-25/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================

Trust: 2.16

sources: NVD: CVE-2012-0284 // JVNDB: JVNDB-2012-003237 // BID: 54588 // VULHUB: VHN-53565 // VULMON: CVE-2012-0284 // PACKETSTORM: 114807

IOT TAXONOMY

category:['camera device']sub_category:video camera

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:ciscomodel:linksys playerpt activex controlscope:eqversion:1.0.0.15

Trust: 2.4

vendor:ciscomodel:wireless-g ptz internet video camera wvc200scope:eqversion:0

Trust: 0.3

sources: BID: 54588 // JVNDB: JVNDB-2012-003237 // CNNVD: CNNVD-201207-391 // NVD: CVE-2012-0284

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-0284
value: HIGH

Trust: 1.0

NVD: CVE-2012-0284
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201207-391
value: CRITICAL

Trust: 0.6

VULHUB: VHN-53565
value: HIGH

Trust: 0.1

VULMON: CVE-2012-0284
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2012-0284
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-53565
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-53565 // VULMON: CVE-2012-0284 // JVNDB: JVNDB-2012-003237 // CNNVD: CNNVD-201207-391 // NVD: CVE-2012-0284

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-53565 // JVNDB: JVNDB-2012-003237 // NVD: CVE-2012-0284

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201207-391

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201207-391

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-003237

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-53565 // 
            
            
            
            VULMON: CVE-2012-0284

PATCH
title:Cisco WVC200 Wireless-G PTZ Internet Video Camera - Audiourl:http://www.cisco.com/en/US/products/ps9946/index.html
Trust: 0.8
title:Top Pageurl:http://www.cisco.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2012-003237

EXTERNAL IDS
db:NVDid:CVE-2012-0284
Trust: 3.1
db:BIDid:54588
Trust: 1.5
db:SECTRACKid:1027259
Trust: 1.2
db:JVNDBid:JVNDB-2012-003237
Trust: 0.8
db:CNNVDid:CNNVD-201207-391
Trust: 0.7
db:NSFOCUSid:20194
Trust: 0.6
db:PACKETSTORMid:114807
Trust: 0.2
db:EXPLOIT-DBid:20202
Trust: 0.2
db:OTHERid:NONE
Trust: 0.1
db:PACKETSTORMid:115237
Trust: 0.1
db:EXPLOIT-DBid:18641
Trust: 0.1
db:SEEBUGid:SSVID-74089
Trust: 0.1
db:SEEBUGid:SSVID-72707
Trust: 0.1
db:VULHUBid:VHN-53565
Trust: 0.1
db:VULMONid:CVE-2012-0284
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            VULHUB: VHN-53565 // 
            
            
            
            VULMON: CVE-2012-0284 // 
            
            
            
            BID: 54588 // 
            
            
            
            JVNDB: JVNDB-2012-003237 // 
            
            
            
            PACKETSTORM: 114807 // 
            
            
            
            CNNVD: CNNVD-201207-391 // 
            
            
            
            NVD: CVE-2012-0284

REFERENCES
url:http://secunia.com/secunia_research/2012-25/
Trust: 1.9
url:http://www.securityfocus.com/bid/54588
Trust: 1.3
url:http://archives.neohapsis.com/archives/bugtraq/2012-07/0113.html
Trust: 1.2
url:http://www.securitytracker.com/id?1027259
Trust: 1.2
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/77085
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0284
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-0284
Trust: 0.8
url:http://www.nsfocus.net/vulndb/20194
Trust: 0.6
url:https://ieeexplore.ieee.org/abstract/document/10769424
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=26433
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.exploit-db.com/exploits/20202/
Trust: 0.1
url:https://www.rapid7.com/db/modules/exploit/windows/browser/cisco_playerpt_setsource_surl
Trust: 0.1
url:http://secunia.com/secunia_research/
Trust: 0.1
url:http://secunia.com/corporate/jobs/
Trust: 0.1
url:http://secunia.com/advisories/mailing_lists/
Trust: 0.1
url:http://secunia.com/advisories/
Trust: 0.1
url:http://secunia.com/advisories/business_solutions/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2012-0284
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            VULHUB: VHN-53565 // 
            
            
            
            VULMON: CVE-2012-0284 // 
            
            
            
            JVNDB: JVNDB-2012-003237 // 
            
            
            
            PACKETSTORM: 114807 // 
            
            
            
            CNNVD: CNNVD-201207-391 // 
            
            
            
            NVD: CVE-2012-0284

CREDITS
Carsten Eiram
Trust: 0.4
sources:
            
            
            BID: 54588 // 
            
            
            
            PACKETSTORM: 114807

SOURCES
db:OTHERid: - 
db:VULHUBid:VHN-53565
db:VULMONid:CVE-2012-0284
db:BIDid:54588
db:JVNDBid:JVNDB-2012-003237
db:PACKETSTORMid:114807
db:CNNVDid:CNNVD-201207-391
db:NVDid:CVE-2012-0284

LAST UPDATE DATE
2025-04-11T21:21:30.734000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-53565date:2017-08-29T00:00:00
db:VULMONid:CVE-2012-0284date:2017-08-29T00:00:00
db:BIDid:54588date:2012-07-17T00:00:00
db:JVNDBid:JVNDB-2012-003237date:2012-07-23T00:00:00
db:CNNVDid:CNNVD-201207-391date:2012-07-20T00:00:00
db:NVDid:CVE-2012-0284date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-53565date:2012-07-19T00:00:00
db:VULMONid:CVE-2012-0284date:2012-07-19T00:00:00
db:BIDid:54588date:2012-07-17T00:00:00
db:JVNDBid:JVNDB-2012-003237date:2012-07-23T00:00:00
db:PACKETSTORMid:114807date:2012-07-17T21:36:33
db:CNNVDid:CNNVD-201207-391date:2012-07-20T00:00:00
db:NVDid:CVE-2012-0284date:2012-07-19T15:55:02.673