ID
VAR-201412-0683
TITLE
Buffer Overflow Vulnerability in Multiple IPUX Network Cameras 'UltraSVCamX.ocx'
Trust: 0.6
DESCRIPTION
IPUX is a provider of network monitoring solutions. Multiple IPUX network cameras (IPUX ICL5132 and ICL5452) have buffer overflows in their implementation. An attacker could exploit this vulnerability to execute arbitrary code in the context of an affected system. IPUX IP Camera is a webcam device. IPUX IP Camera UltraSVCam ActiveX space 'UltraSVCamX.ocx' has a buffer overflow vulnerability that can cause memory corruption when a large number of bytes are passed to multiple functions in UltraSVCamLib, causing an application to crash or execute arbitrary code. Multiple IPUX IP Camera products are prone to multiple buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data. Failed exploit attempts will likely result in denial-of-service conditions. IPUX ICL5132 and ICL5452 are vulnerable. The device is H.264 Wired/Wireless IP Camera with 1.3 Mega-pixel sensor.With high performance H.264 video compression, the file size of video stream isextremely reduced, as to optimize the network bandwidth efficiency. It has fullPan/Tilt function and 3X digital zoom feature for a larger space monitoring. Thebuilt-in USB port provides a convenient and portable storage option for local storageof event and schedule recording, especially network disconnected.The UltraSVCam ActiveX Control 'UltraSVCamX.ocx' suffers from a stack bufferoverflow vulnerability when parsing large amount of bytes to several functions inUltraSVCamLib, resulting in memory corruption overwriting several registers includingthe SEH. An attacker can gain access to the system of the affected node and executearbitrary code.<br/><br/>--------------------------------------------------------------------------------<br/><br/><code>(3ef0.3e0c): Access violation - code c0000005 (first chance)<br/>First chance exceptions are reported before any exception handling.<br/>This exception may be expected and handled.<br/>*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\Downloaded Program Files\UltraSVCamX.ocx - <br/>eax=41414149 ebx=00000001 ecx=00003e0c edx=02163f74 esi=41414141 edi=02163f74<br/>eip=77e8466c esp=003eef8c ebp=003eefc0 iopl=0 nv up ei pl zr na pe nc<br/>cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246<br/>ntdll!RtlDeleteCriticalSection+0x77:<br/>77e8466c 833800 cmp dword ptr [eax],0 ds:002b:41414149=????????<br/></code><br/> --------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows 7 Professional SP1 (EN)
Trust: 1.71
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 1.2 |
AFFECTED PRODUCTS
| vendor: | ipux | model: | ip camera icl5452 | scope: | - | version: | - | Trust: 0.6 |
| vendor: | ipux | model: | ip camera icl5132 | scope: | - | version: | - | Trust: 0.6 |
| vendor: | ipux | model: | ip camera | scope: | - | version: | - | Trust: 0.6 |
| vendor: | big good holdings | model: | ipux cl | scope: | eq | version: | bullet type icl5132 (firmware: icl5132 2.0.0-2 20130730 r1112) | Trust: 0.1 |
| vendor: | big good holdings | model: | ipux cl | scope: | eq | version: | bullet type icl5452 | Trust: 0.1 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
THREAT TYPE
network
Trust: 0.6
TYPE
Input Validation Error
Trust: 0.6
EXPLOIT AVAILABILITY
EXTERNAL IDS
| db: | BID | id: | 71405 | Trust: 1.0 |
| db: | BID | id: | 71403 | Trust: 1.0 |
| db: | ZSL | id: | ZSL-2014-5213 | Trust: 0.7 |
| db: | CNVD | id: | CNVD-2014-08799 | Trust: 0.6 |
| db: | CNVD | id: | CNVD-2014-08748 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 129346 | Trust: 0.1 |
| db: | EXPLOIT-DB | id: | 35421 | Trust: 0.1 |
| db: | CXSECURITY | id: | WLB-2014120006 | Trust: 0.1 |
| db: | OSVDB | id: | 115369 | Trust: 0.1 |
REFERENCES
| url: | http://www.securityfocus.com/bid/71403 | Trust: 0.7 |
| url: | http://www.zeroscience.mk/en/vulnerabilities/zsl-2014-5213.php | Trust: 0.6 |
| url: | http://packetstormsecurity.com/files/129346 | Trust: 0.1 |
| url: | http://cxsecurity.com/issue/wlb-2014120006 | Trust: 0.1 |
| url: | http://www.exploit-db.com/exploits/35421/ | Trust: 0.1 |
| url: | http://www.securityfocus.com/bid/71405 | Trust: 0.1 |
| url: | http://osvdb.org/show/osvdb/115369 | Trust: 0.1 |
CREDITS
LiquidWorm
Trust: 0.6
SOURCES
| db: | ZSL | id: | ZSL-2014-5213 |
| db: | CNVD | id: | CNVD-2014-08799 |
| db: | CNVD | id: | CNVD-2014-08748 |
| db: | BID | id: | 71403 |
| db: | BID | id: | 71405 |
LAST UPDATE DATE
2022-10-19T22:41:31.097000+00:00
SOURCES UPDATE DATE
| db: | ZSL | id: | ZSL-2014-5213 | date: | 2014-12-06T00:00:00 |
| db: | CNVD | id: | CNVD-2014-08799 | date: | 2014-12-10T00:00:00 |
| db: | CNVD | id: | CNVD-2014-08748 | date: | 2014-12-08T00:00:00 |
| db: | BID | id: | 71403 | date: | 2014-12-02T00:00:00 |
| db: | BID | id: | 71405 | date: | 2014-12-02T00:00:00 |
SOURCES RELEASE DATE
| db: | ZSL | id: | ZSL-2014-5213 | date: | 2014-12-02T00:00:00 |
| db: | CNVD | id: | CNVD-2014-08799 | date: | 2014-12-10T00:00:00 |
| db: | CNVD | id: | CNVD-2014-08748 | date: | 2014-12-08T00:00:00 |
| db: | BID | id: | 71403 | date: | 2014-12-02T00:00:00 |
| db: | BID | id: | 71405 | date: | 2014-12-02T00:00:00 |