full-disclosure-uk January 2009 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] Secunia Research: AXIS

Re: [Full-disclosure] Secunia Research: AXIS Camera Control "image_pan_tilt" Property Buffer Overflow

From: M.B.Jr. <marcio.barbado_at_nospam>
Date: Fri Jan 23 2009 - 14:32:54 GMT
To: Secunia Research <remove-vuln@secunia.com>


So, concerning the exploitation achievement, which would be the worst consequence,
forget about that heap memory overflow and just worry about tricking the user into loading malicious web content.

Easier, huh?

On Fri, Jan 23, 2009 at 6:59 AM, Secunia Research <remove-vuln@secunia.com> wrote:
> ======================================================================
>
> Secunia Research 23/01/2009
>
> - AXIS Camera Control "image_pan_tilt" Property Buffer Overflow -
>
> ======================================================================
> ======================================================================
> 4) Description of Vulnerability
>
> The vulnerability is caused due to a boundary error in the
> CamImage.CamImage.1 ActiveX control (AxisCamControl.ocx) and can be
> exploited to cause a heap-based buffer overflow by assigning an overly
> long string to the "image_pan_tilt" property.
>
> Successful exploitation allows execution of arbitrary code, but
> requires that the user is tricked into visiting and clicking a
> malicious web page.
>
> ======================================================================
-- Marcio Barbado, Jr. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/