Details of VAR-201401-0557

ID

VAR-201401-0557

CVE

CVE-2014-1201

TITLE

plural Lorex Edge Product firmware INetViewX ActiveX Control buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-001177

DESCRIPTION

Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter. Lorex Security DVR Edge Series is the Edge series of digital video recorder products from Lorex Technologies of the United States. A remote buffer overflow vulnerability exists in Lorex Security DVR Edge Series. Failed exploit attempts will result in a denial-of-service condition. Hi, I have discovered a buffer overflow vulnerability that allows remote code execution in an ActiveX control bundled by a manufacturer of video surveillance systems. The company is Lorex Technologies, a major video surveillance manufacturer that is very popular in the US and East Asia. I have confirmed that all 16 are vulnerable at this point in time. The Lorex manual[1] instructs the user to blindly accept the ActiveX control install when prompted. The full list of devices, as well as links to the firware download, can be found in [2]. Their products offer remote video viewing capabilities, and you can find some of them on Shodan[3]. The buffer overflow can be triggered by a really long string (10000+ characters) in the HTTP_PORT parameter. The instruction pointer can be very easily controlled in XP by the characters 109 to 113 in the string. Please refer to the PoC file lorex-testcase.html. You will see that the HTTP_PORT parameter is composed of D's, apart from chars 109 to 113 which are four A's. If you open this file in IE after installing the control, you will see that IE will crash with an EIP of 0x41414141. Changing the four A's to any other value will cause EIP to crash on that value. The list below tells a better story about what is affected and how it can be controlled: Win XP SP3 with IE6 - Fully exploitable as described Win XP SP3 with IE8 - Could not get it to crash (????) Win 7 x64 with IE10 fully patched - Fully exploitable, though not as easy as for XP (see analyze -v [4] and !exploitable [5] outputs) To verify this vulnerability you can download and extract the firmware using binwalk (http://code.google.com/p/binwalk/). To do so, please follow the instructions in [6], and then install the ActiveX control in INetViewProj1_02030330.cab. I have contacted Lorex and they initially said they would fix it, but went radio silent shortly afterwards. 17.11.2013 - Initial contact via support page 18.11.2013 - Email to sales, no response. 21.11.2013 - Second email to sales, received response by sales saying they will forward it to technical support and get back to me. 04.12.2013 - Third email to sales saying that technical support never contacted me back. No response. 08.01.2013 - MITRE assigns CVE-2014-1201 to this issue. 09.01.2013 - Public disclosure. All references can be found at: https://github.com/pedrib/PoC/lorexActivex/lorex-report.txt Proof of concept: https://github.com/pedrib/PoC/lorexActivex/lorex-testcase.html Regards, Pedro Ribeiro (pedrib@gmail.com) Agile Information Security

Trust: 2.61

sources: NVD: CVE-2014-1201 // JVNDB: JVNDB-2014-001177 // CNVD: CNVD-2014-00385 // BID: 64783 // VULHUB: VHN-69139 // PACKETSTORM: 124744

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2014-00385

AFFECTED PRODUCTS

vendor:	lorex	model:	edge lh310	scope:	eq	version:	7-35-28-1b26e	Trust: 1.6
vendor:	lorex	model:	edge3 lh340	scope:	eq	version:	11.19.85_1fe3a	Trust: 1.6
vendor:	lorex	model:	edge\+ lh320	scope:	eq	version:	7-35-28-1b26e	Trust: 1.6
vendor:	lorex	model:	edge2 lh330	scope:	eq	version:	11.17.38-33_1d97a	Trust: 1.6
vendor:	lorextechnology	model:	edge\+	scope:	eq	version:	lh320	Trust: 1.0
vendor:	lorextechnology	model:	edge	scope:	eq	version:	lh310	Trust: 1.0
vendor:	lorextechnology	model:	edge2	scope:	eq	version:	lh330	Trust: 1.0
vendor:	lorextechnology	model:	edge3	scope:	eq	version:	lh340	Trust: 1.0
vendor:	lorex	model:	edge	scope:	eq	version:	lh310 series	Trust: 0.8
vendor:	lorex	model:	edge lh310 series	scope:	eq	version:	7-35-28-1b26e	Trust: 0.8
vendor:	lorex	model:	edge+	scope:	eq	version:	lh320 series	Trust: 0.8
vendor:	lorex	model:	edge+ lh320 series	scope:	eq	version:	7-35-28-1b26e	Trust: 0.8
vendor:	lorex	model:	edge2	scope:	eq	version:	lh330 series	Trust: 0.8
vendor:	lorex	model:	edge2 lh330 series	scope:	eq	version:	11.17.38-33_1d97a	Trust: 0.8
vendor:	lorex	model:	edge3	scope:	eq	version:	lh340 series	Trust: 0.8
vendor:	lorex	model:	edge3 lh340 series	scope:	eq	version:	11.19.85_1fe3a	Trust: 0.8
vendor:	lorex lorex	model:	activex control	scope:	-	version:	-	Trust: 0.6
vendor:	lorex	model:	technology security dvr	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2014-00385 // BID: 64783 // JVNDB: JVNDB-2014-001177 // CNNVD: CNNVD-201401-182 // NVD: CVE-2014-1201

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-1201
value:	HIGH
Trust: 1.0
NVD:	CVE-2014-1201
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2014-00385
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201401-182
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-69139
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2014-1201
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2014-00385
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-69139
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CNVD: CNVD-2014-00385 // VULHUB: VHN-69139 // JVNDB: JVNDB-2014-001177 // CNNVD: CNNVD-201401-182 // NVD: CVE-2014-1201

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-69139 // JVNDB: JVNDB-2014-001177 // NVD: CVE-2014-1201

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201401-182

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201401-182

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-001177

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-69139

PATCH

title:

Security DVR

url:

http://www.lorextechnology.com/product/info/Security-dvrs-digital-video-security-recorders/2000035

Trust: 0.8

sources: JVNDB: JVNDB-2014-001177

EXTERNAL IDS

db:	NVD	id:	CVE-2014-1201	Trust: 3.5
db:	OSVDB	id:	101903	Trust: 1.7
db:	BID	id:	64783	Trust: 1.6
db:	XF	id:	90223	Trust: 1.2
db:	JVNDB	id:	JVNDB-2014-001177	Trust: 0.8
db:	CNNVD	id:	CNNVD-201401-182	Trust: 0.7
db:	CNVD	id:	CNVD-2014-00385	Trust: 0.6
db:	BUGTRAQ	id:	20140110 [CVE -2014-1201] LOREX SECURITY DVR ACTIVEX CONTROL BUFFER OVERFLOW	Trust: 0.6
db:	XF	id:	20141201	Trust: 0.6
db:	PACKETSTORM	id:	124744	Trust: 0.2
db:	EXPLOIT-DB	id:	43891	Trust: 0.1
db:	VULHUB	id:	VHN-69139	Trust: 0.1

sources: CNVD: CNVD-2014-00385 // VULHUB: VHN-69139 // BID: 64783 // JVNDB: JVNDB-2014-001177 // PACKETSTORM: 124744 // CNNVD: CNNVD-201401-182 // NVD: CVE-2014-1201

REFERENCES

url:	https://github.com/pedrib/poc/blob/master/lorexactivex/lorex-testcase.html	Trust: 3.1
url:	https://github.com/pedrib/poc/blob/master/lorexactivex/lorex-report.txt	Trust: 2.5
url:	http://osvdb.org/101903	Trust: 1.7
url:	http://xforce.iss.net/xforce/xfdb/90223	Trust: 1.2
url:	http://www.securityfocus.com/archive/1/530739/100/0/threaded	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/90223	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-1201	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-1201	Trust: 0.8
url:	http://www.securityfocus.com/archive/1/archive/1/530739/100/0/threaded	Trust: 0.6
url:	http://www.securityfocus.com/bid/64783	Trust: 0.6
url:	http://seclists.org/fulldisclosure/2014/jan/41	Trust: 0.3
url:	http://www.lorextechnology.com/product/info/security-dvrs-digital-video-security-recorders/2000035	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2014-1201	Trust: 0.1
url:	http://code.google.com/p/binwalk/).	Trust: 0.1
url:	https://github.com/pedrib/poc/lorexactivex/lorex-testcase.html	Trust: 0.1
url:	https://github.com/pedrib/poc/lorexactivex/lorex-report.txt	Trust: 0.1

sources: CNVD: CNVD-2014-00385 // VULHUB: VHN-69139 // BID: 64783 // JVNDB: JVNDB-2014-001177 // PACKETSTORM: 124744 // CNNVD: CNNVD-201401-182 // NVD: CVE-2014-1201

CREDITS

Pedro Ribeiro

Trust: 1.0

sources: BID: 64783 // PACKETSTORM: 124744 // CNNVD: CNNVD-201401-182

SOURCES

db:	CNVD	id:	CNVD-2014-00385
db:	VULHUB	id:	VHN-69139
db:	BID	id:	64783
db:	JVNDB	id:	JVNDB-2014-001177
db:	PACKETSTORM	id:	124744
db:	CNNVD	id:	CNNVD-201401-182
db:	NVD	id:	CVE-2014-1201

LAST UPDATE DATE

2025-04-11T23:10:34.304000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2014-00385	date:	2014-01-17T00:00:00
db:	VULHUB	id:	VHN-69139	date:	2018-10-09T00:00:00
db:	BID	id:	64783	date:	2014-01-09T00:00:00
db:	JVNDB	id:	JVNDB-2014-001177	date:	2014-01-20T00:00:00
db:	CNNVD	id:	CNNVD-201401-182	date:	2014-01-20T00:00:00
db:	NVD	id:	CVE-2014-1201	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2014-00385	date:	2014-01-17T00:00:00
db:	VULHUB	id:	VHN-69139	date:	2014-01-15T00:00:00
db:	BID	id:	64783	date:	2014-01-09T00:00:00
db:	JVNDB	id:	JVNDB-2014-001177	date:	2014-01-20T00:00:00
db:	PACKETSTORM	id:	124744	date:	2014-01-10T10:22:22
db:	CNNVD	id:	CNNVD-201401-182	date:	2014-01-14T00:00:00
db:	NVD	id:	CVE-2014-1201	date:	2014-01-15T16:08:18.297