Vulnerability Note VU#547255
Dahua IP cameras Sonia web interface is vulnerable to stack buffer overflow
Original Release date: 18 Jul 2017 | Last revised: 26 Jul 2017

Overview
Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow.

Description
CWE-121: Stack-based Buffer Overflow – CVE-2017-3223
Dahua IP camera products include an application known as Sonia (/usr/bin/sonia) that provides the web interface and other services for controlling the IP camera remotely.

Versions of Sonia included in firmware versions prior to DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 do not validate input data length for the ‘password’ field of the web interface.

A remote, unauthenticated attacker may submit a crafted POST request to the IP camera’s Sonia web interface that may lead to out-of-bounds memory operations and loss of availability or remote code execution.

The issue was originally identified by the researcher in firmware version DH_IPC-HX1X2X-Themis_EngSpnFrn_N_V2.400.0000.30.R.20160803.

Impact
A remote, unauthenticated attacker may submit a crafted POST request to the IP camera’s Sonia web interface that may lead to out-of-bounds memory operations and loss of availability or remote code execution.

Solution
Apply update

Dahua has released firmware version DH_IPC-ACK-Themis_Eng_P_V2.400.0000.14.R.20170713.bin to address this issue.

All affected users should update their firmware as soon as possible.
If you have any questions, you may contact cybersecurity@dahuatech.com.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedDahua SecurityAffected31 May 201717 Jul 2017If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal
7.8
E:POC/RL:OF/RC:C

Environmental
5.9
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

http://www.dahuasecurity.com/firmware_161.html
http://cwe.mitre.org/data/definitions/121.html

Credit

Thanks to Ilya Smith of Positive Technologies for reporting this vulnerability.
This document was written by Garret Wassermann.

Other Information

CVE IDs:
CVE-2017-3223

Date Public:
18 Jul 2017

Date First Published:
18 Jul 2017

Date Last Updated:
26 Jul 2017

Document Revision:
42

FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.

Leave a Reply