Posted on

VU#547255: Dahua IP cameras' Sonia web interface is vulnerable to stack buffer overflow

Vulnerability Note VU#547255

     <h2>Dahua IP cameras' Sonia web interface is vulnerable to stack buffer overflow</h2>
     <p class="meta-text">Original Release date: 18 Jul 2017 | Last revised: 18 Jul 2017</p><!-- END SOCIAL BUTTONS -->

 

Overview

Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow.

Description

CWE-121: Stack-based Buffer Overflow - CVE-2017-3223

Dahua IP camera products include an application known as Sonia (/usr/bin/sonia) that provides the web interface and other services for controlling the IP camera remotely.

Versions of Sonia included in firmware versions prior to DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 do not validate input data length for the 'password' field of the web interface. A remote, unauthenticated attacker may submit a crafted POST request to the IP camera’s Sonia web interface that may lead to out-of-bounds memory operations and loss of availability or remote code execution.

The issue was originally identified by the researcher in firmware version DH_IPC-HX1X2X-Themis_EngSpnFrn_N_V2.400.0000.30.R.20160803.

Impact

A remote, unauthenticated attacker may submit a crafted POST request to the IP camera’s Sonia web interface that may lead to out-of-bounds memory operations and loss of availability or remote code execution.

Solution

Apply update

Dahua has released firmware version DH_IPC-ACK-Themis_Eng_P_V2.400.0000.14.R.20170713.bin to address this issue. All affected users should update their firmware as soon as possible. If you have any questions, you may contact [email protected].

     
     

Vendor Information (Learn More)

Vendor Status Date Notified Date Updated
Dahua Security Affected 31 May 2017 17 Jul 2017

If you are a vendor and your product is affected, let
us know
.

CVSS Metrics (Learn More)

Group Score Vector
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal 7.8 E:POC/RL:OF/RC:C
Environmental 5.9 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND
     
     

References

  • http://www.dahuasecurity.com/firmware_161.html
  • http://cwe.mitre.org/data/definitions/121.html
  •     
    
         
         

    Credit

    Thanks to Ilya Smith and Yury Maryshev for reporting this vulnerability.

    This document was written by Garret Wassermann.

    Other Information

    • CVE IDs:
      CVE-2017-3223
    •          
    • Date Public: 18 Jul 2017
    • Date First Published: 18 Jul 2017
    • Date Last Updated: 18 Jul 2017
    • Document Revision: 35

    Feedback

    If you have feedback, comments, or additional information about this vulnerability, please send us email.