Vulnerability Note VU#547255
<h2>Dahua IP cameras' Sonia web interface is vulnerable to stack buffer overflow</h2> <p class="meta-text">Original Release date: 18 Jul 2017 | Last revised: 18 Jul 2017</p><!-- END SOCIAL BUTTONS -->
OverviewDahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow.
CWE-121: Stack-based Buffer Overflow - CVE-2017-3223
Dahua IP camera products include an application known as Sonia (/usr/bin/sonia) that provides the web interface and other services for controlling the IP camera remotely.
Versions of Sonia included in firmware versions prior to DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 do not validate input data length for the 'password' field of the web interface. A remote, unauthenticated attacker may submit a crafted POST request to the IP camera’s Sonia web interface that may lead to out-of-bounds memory operations and loss of availability or remote code execution.
The issue was originally identified by the researcher in firmware version DH_IPC-HX1X2X-Themis_EngSpnFrn_N_V2.400.0000.30.R.20160803.
A remote, unauthenticated attacker may submit a crafted POST request to the IP camera’s Sonia web interface that may lead to out-of-bounds memory operations and loss of availability or remote code execution.
Dahua has released firmware version DH_IPC-ACK-Themis_Eng_P_V2.400.0000.14.R.20170713.bin to address this issue. All affected users should update their firmware as soon as possible. If you have any questions, you may contact [email protected].
Vendor Information (Learn More)
Vendor Status Date Notified Date Updated Dahua Security Affected 31 May 2017 17 Jul 2017
If you are a vendor and your product is affected, let
CVSS Metrics (Learn More)
Group Score Vector Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C Temporal 7.8 E:POC/RL:OF/RC:C Environmental 5.9 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND http://www.dahuasecurity.com/firmware_161.html http://cwe.mitre.org/data/definitions/121.html
Thanks to Ilya Smith and Yury Maryshev for reporting this vulnerability.
- CVE IDs:
Date Public: 18 Jul 2017 Date First Published: 18 Jul 2017 Date Last Updated: 18 Jul 2017 Document Revision: 35
If you have feedback, comments, or additional information about this vulnerability, please send us email.