Sign-up

ID

VAR-201210-0439


CVE

CVE-2012-5306


TITLE

D-Link DCS-5605 PTZ ActiveX Control 'SelectDirectory()' Method Buffer Overflow Vulnerability

Trust: 0.9

sources: CNVD: CNVD-2012-1651 // BID: 52769

DESCRIPTION

Stack-based buffer overflow in the SelectDirectory method in DcsCliCtrl.dll in Camera Stream Client ActiveX Control, as used in D-Link DCS-5605 PTZ IP Network Camera, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string argument. The D-Link DCS-5605 is a webcam product for remote monitoring. When browsing the device WEB interface, the user will be asked to install the Active control to view the video stream content. The control contained in the DcsCliCtrl.dll uses the unsafe SelectDirectory() method. Since DcsCliCtrl.dll is called with an unsafe lstrcpyW() call, Special parameters trigger a stack-based buffer overflow. D-Link DCS-5605 PTZ is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. An attacker can exploit this issue to execute arbitrary code within the context of the application, typically Internet Explorer, that uses the ActiveX control. Failed exploit attempts will result in denial-of-service conditions. D-Link is a network company founded by Taiwan D-Link Group, dedicated to the R&D, production and marketing of LAN, broadband network, wireless network, voice network and related network equipment. ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: Camera Stream Client ActiveX Control "SetDirectory()" Buffer Overflow SECUNIA ADVISORY ID: SA48602 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48602/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48602 RELEASE DATE: 2012-03-29 DISCUSS ADVISORY: http://secunia.com/advisories/48602/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/48602/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=48602 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Andrea Micalizzi has discovered a vulnerability in Camera Stream Client ActiveX Control, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to a boundary error when handling the "SetDirectory()" method and can be exploited to cause a stack-based buffer overflow by passing an overly long argument. Successful exploitation allows execution of arbitrary code, but requires users to click "OK" to select a directory in the displayed "Browse for Folder" dialog box instead of "Cancel". The vulnerability is confirmed in version 1.0.0.4519 bundled with DCS-5605 firmware 1.02 and version 1.0.0.4617 bundled with D-Link DCS-2102 firmware 1.05. Other versions may also be affected. SOLUTION: Set the kill-bit for the affected ActiveX control. PROVIDED AND/OR DISCOVERED BY: Andrea Micalizzi (rgod) ORIGINAL ADVISORY: http://retrogod.altervista.org/9sg_dlink_adv.htm OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.61

sources: NVD: CVE-2012-5306 // JVNDB: JVNDB-2012-004767 // CNVD: CNVD-2012-1651 // BID: 52769 // VULHUB: VHN-58587 // PACKETSTORM: 111380

IOT TAXONOMY

category:['IoT', 'Network device']sub_category: -

Trust: 0.6

category:['camera device']sub_category:IP camera

Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2012-1651

AFFECTED PRODUCTS

vendor:dlinkmodel:dcs-5605 ptz ip network camerascope:eqversion: -

Trust: 1.0

vendor:dlinkmodel:camera stream client activex controlscope:eqversion:1.0.0.4519

Trust: 1.0

vendor:d linkmodel:dcs-5605 ptzscope:eqversion:0

Trust: 0.9

vendor:d linkmodel:camera stream client activex controlscope: - version: -

Trust: 0.8

vendor:d linkmodel:dcs-5605scope: - version: -

Trust: 0.8

vendor:d linkmodel:dcs-5605 ptz ip network camerascope:eqversion: -

Trust: 0.6

vendor:d linkmodel:camera stream client activex controlscope:eqversion:1.0.0.4519

Trust: 0.6

sources: CNVD: CNVD-2012-1651 // BID: 52769 // JVNDB: JVNDB-2012-004767 // CNNVD: CNNVD-201203-543 // NVD: CVE-2012-5306

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-5306
value: HIGH

Trust: 1.0

NVD: CVE-2012-5306
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201203-543
value: CRITICAL

Trust: 0.6

VULHUB: VHN-58587
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2012-5306
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-58587
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-58587 // JVNDB: JVNDB-2012-004767 // CNNVD: CNNVD-201203-543 // NVD: CVE-2012-5306

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-58587 // JVNDB: JVNDB-2012-004767 // NVD: CVE-2012-5306

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201203-543

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201203-543

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-004767

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-58587

PATCH
title:DCS-5605url:http://www.dlink.com/us/en/business-solutions/ip-surveillance/business-ip-cameras/ptz-cameras/dcs-5605-securicam-h-264-ptz-network-camera
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2012-004767

EXTERNAL IDS
db:NVDid:CVE-2012-5306
Trust: 2.9
db:BIDid:52769
Trust: 2.6
db:SECUNIAid:48602
Trust: 1.8
db:EXPLOIT-DBid:18673
Trust: 1.7
db:OSVDBid:80663
Trust: 1.7
db:JVNDBid:JVNDB-2012-004767
Trust: 0.8
db:CNNVDid:CNNVD-201203-543
Trust: 0.7
db:CNVDid:CNVD-2012-1651
Trust: 0.6
db:OTHERid:NONE
Trust: 0.1
db:SEEBUGid:SSVID-72731
Trust: 0.1
db:VULHUBid:VHN-58587
Trust: 0.1
db:PACKETSTORMid:111380
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            CNVD: CNVD-2012-1651 // 
            
            
            
            VULHUB: VHN-58587 // 
            
            
            
            BID: 52769 // 
            
            
            
            JVNDB: JVNDB-2012-004767 // 
            
            
            
            PACKETSTORM: 111380 // 
            
            
            
            CNNVD: CNNVD-201203-543 // 
            
            
            
            NVD: CVE-2012-5306

REFERENCES
url:http://www.securityfocus.com/bid/52769
Trust: 1.7
url:http://archives.neohapsis.com/archives/bugtraq/2012-03/0154.html
Trust: 1.7
url:http://www.exploit-db.com/exploits/18673
Trust: 1.7
url:http://osvdb.org/80663
Trust: 1.7
url:http://secunia.com/advisories/48602
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/74447
Trust: 1.7
url:http://retrogod.altervista.org/9sg_dlink_adv.htm
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-5306
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-5306
Trust: 0.8
url:http://www.d-link.com
Trust: 0.3
url:http://www.d-link.com/products/?pid=771
Trust: 0.3
url:https://ieeexplore.ieee.org/abstract/document/10769424
Trust: 0.1
url:http://secunia.com/psi_30_beta_launch
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=48602
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/48602/#comments
Trust: 0.1
url:http://secunia.com/advisories/48602/
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            CNVD: CNVD-2012-1651 // 
            
            
            
            VULHUB: VHN-58587 // 
            
            
            
            BID: 52769 // 
            
            
            
            JVNDB: JVNDB-2012-004767 // 
            
            
            
            PACKETSTORM: 111380 // 
            
            
            
            CNNVD: CNNVD-201203-543 // 
            
            
            
            NVD: CVE-2012-5306

CREDITS
rgod
Trust: 0.9
sources:
            
            
            BID: 52769 // 
            
            
            
            CNNVD: CNNVD-201203-543

SOURCES
db:OTHERid: - 
db:CNVDid:CNVD-2012-1651
db:VULHUBid:VHN-58587
db:BIDid:52769
db:JVNDBid:JVNDB-2012-004767
db:PACKETSTORMid:111380
db:CNNVDid:CNNVD-201203-543
db:NVDid:CVE-2012-5306

LAST UPDATE DATE
2025-04-11T19:48:22.058000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2012-1651date:2012-03-30T00:00:00
db:VULHUBid:VHN-58587date:2017-08-29T00:00:00
db:BIDid:52769date:2012-10-10T18:10:00
db:JVNDBid:JVNDB-2012-004767date:2012-10-09T00:00:00
db:CNNVDid:CNNVD-201203-543date:2023-04-27T00:00:00
db:NVDid:CVE-2012-5306date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2012-1651date:2012-03-30T00:00:00
db:VULHUBid:VHN-58587date:2012-10-06T00:00:00
db:BIDid:52769date:2012-03-28T00:00:00
db:JVNDBid:JVNDB-2012-004767date:2012-10-09T00:00:00
db:PACKETSTORMid:111380date:2012-03-30T01:49:18
db:CNNVDid:CNNVD-201203-543date:2012-03-30T00:00:00
db:NVDid:CVE-2012-5306date:2012-10-06T22:55:02.307