Sign-up

ID

VAR-201406-0356


CVE

CVE-2014-3912


TITLE

Samsung iPOLiS Device Manager 'FindConfigChildeKeyList()' method stack buffer overflow vulnerability

Trust: 0.9

sources: CNVD: CNVD-2014-03531 // BID: 67823

DESCRIPTION

Stack-based buffer overflow in the FindConfigChildeKeyList method in the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control in Samsung iPOLiS Device Manager before 1.8.7 allows remote attackers to execute arbitrary code via a long value. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control. Samsung iPOLiS Device Manager is a webcam device management program

Trust: 3.06

sources: NVD: CVE-2014-3912 // JVNDB: JVNDB-2014-002762 // ZDI: ZDI-14-169 // CNVD: CNVD-2014-03531 // BID: 67823

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-03531

AFFECTED PRODUCTS

vendor:samsungmodel:ipolis device managerscope: - version: -

Trust: 1.3

vendor:samsungmodel:ipolis device managerscope:lteversion:1.8.2

Trust: 1.0

vendor:samsungmodel:ipolis device managerscope:ltversion:1.8.7

Trust: 0.8

vendor:samsungmodel:ipolis device managerscope:eqversion:1.8.2

Trust: 0.6

sources: ZDI: ZDI-14-169 // CNVD: CNVD-2014-03531 // JVNDB: JVNDB-2014-002762 // CNNVD: CNNVD-201406-064 // NVD: CVE-2014-3912

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-3912
value: HIGH

Trust: 1.0

NVD: CVE-2014-3912
value: HIGH

Trust: 0.8

ZDI: CVE-2014-3912
value: HIGH

Trust: 0.7

CNVD: CNVD-2014-03531
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201406-064
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2014-3912
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ZDI: CVE-2014-3912
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

CNVD: CNVD-2014-03531
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: ZDI: ZDI-14-169 // CNVD: CNVD-2014-03531 // JVNDB: JVNDB-2014-002762 // CNNVD: CNNVD-201406-064 // NVD: CVE-2014-3912

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2014-002762 // NVD: CVE-2014-3912

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201406-064

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201406-064

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-002762

PATCH
title:iPOLiS Device Manager v1.82url:https://www.samsung-security.com/Tools/device-manager.aspx
Trust: 0.8
title:Samsung has issued an update to correct this vulnerability.url:http://update.websamsung.net/Tools/iPOLiS%20Device%20Manager/iPOLiS%20Device%20Manager_v1.8.7_setup_Full.zip
Trust: 0.7
title:Samsung iPOLiS Device Manager 'FindConfigChildeKeyList()' method stack buffer overflow vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/46241
Trust: 0.6
sources:
            
            
            ZDI: ZDI-14-169 // 
            
            
            
            CNVD: CNVD-2014-03531 // 
            
            
            
            JVNDB: JVNDB-2014-002762

EXTERNAL IDS
db:NVDid:CVE-2014-3912
Trust: 4.0
db:BIDid:67823
Trust: 3.3
db:ZDIid:ZDI-14-169
Trust: 2.9
db:JVNDBid:JVNDB-2014-002762
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-2317
Trust: 0.7
db:CNVDid:CNVD-2014-03531
Trust: 0.6
db:CNNVDid:CNNVD-201406-064
Trust: 0.6
sources:
            
            
            ZDI: ZDI-14-169 // 
            
            
            
            CNVD: CNVD-2014-03531 // 
            
            
            
            BID: 67823 // 
            
            
            
            JVNDB: JVNDB-2014-002762 // 
            
            
            
            CNNVD: CNNVD-201406-064 // 
            
            
            
            NVD: CVE-2014-3912

REFERENCES
url:http://www.securityfocus.com/bid/67823
Trust: 2.4
url:http://www.zerodayinitiative.com/advisories/zdi-14-169
Trust: 1.6
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3912
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3912
Trust: 0.8
url:http://update.websamsung.net/tools/ipolis%20device%20manager/ipolis%20device%20manager_v1.8.7_setup_full.zip
Trust: 0.7
url:http://www.zerodayinitiative.com/advisories/zdi-14-169/
Trust: 0.6
sources:
            
            
            ZDI: ZDI-14-169 // 
            
            
            
            CNVD: CNVD-2014-03531 // 
            
            
            
            JVNDB: JVNDB-2014-002762 // 
            
            
            
            CNNVD: CNNVD-201406-064 // 
            
            
            
            NVD: CVE-2014-3912

CREDITS
Andrea Micalizzi (rgod) and Ariele Caltabiano (kimiya)
Trust: 0.7
sources:
            
            
            ZDI: ZDI-14-169

SOURCES
db:ZDIid:ZDI-14-169
db:CNVDid:CNVD-2014-03531
db:BIDid:67823
db:JVNDBid:JVNDB-2014-002762
db:CNNVDid:CNNVD-201406-064
db:NVDid:CVE-2014-3912

LAST UPDATE DATE
2025-04-13T23:35:15.090000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-14-169date:2014-06-04T00:00:00
db:CNVDid:CNVD-2014-03531date:2014-06-10T00:00:00
db:BIDid:67823date:2014-06-04T00:00:00
db:JVNDBid:JVNDB-2014-002762date:2014-06-09T00:00:00
db:CNNVDid:CNNVD-201406-064date:2014-06-09T00:00:00
db:NVDid:CVE-2014-3912date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:ZDIid:ZDI-14-169date:2014-06-04T00:00:00
db:CNVDid:CNVD-2014-03531date:2014-06-10T00:00:00
db:BIDid:67823date:2014-06-04T00:00:00
db:JVNDBid:JVNDB-2014-002762date:2014-06-09T00:00:00
db:CNNVDid:CNNVD-201406-064date:2014-06-09T00:00:00
db:NVDid:CVE-2014-3912date:2014-06-05T17:55:07.090