CVE-2017-13719: Buffer Overflow
First published: Wed Jul 03 2019(Updated: )
The Amcrest IPM-721S Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 allows HTTP requests that permit enabling various functionalities of the camera by using HTTP APIs, instead of the web management interface that is provided by the application. This HTTP API receives the credentials as base64 encoded in the Authorization HTTP header. However, a missing length check in the code allows an attacker to send a string of 1024 characters in the password field, and allows an attacker to exploit a memory corruption issue. This can allow an attacker to circumvent the account protection mechanism and brute force the credentials. If the firmware version Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 is dissected using the binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that has many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that performs the credential check in the binary for the HTTP API specification. If we open this binary in IDA Pro we will notice that this follows an ARM little-endian format. The function at address 00415364 in IDA Pro starts the HTTP authentication process. This function calls another function at sub_ 0042CCA0 at address 0041549C. This function performs a strchr operation after base64 decoding the credentials, and stores the result on the stack, which results in a stack-based buffer overflow.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amcrest Ipm-721s Firmware | =amcrest_ipc-awxx_eng_n_v2.420.ac00.17.r.20170322 | |
| Amcrest IPM-721S |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2017-13719.
What is the severity level of CVE-2017-13719?
The severity level of CVE-2017-13719 is critical with a score of 9.8.
What is the affected software of CVE-2017-13719?
The affected software of CVE-2017-13719 is Amcrest IPM-721S firmware version amcrest_ipc-awxx_eng_n_v2.420.ac00.17.r.20170322.
How can the functionality of the camera be enabled using HTTP APIs?
The functionality of the camera can be enabled using HTTP APIs instead of the web management interface provided by the application.
Are there any references for CVE-2017-13719?
Yes, you can find references for CVE-2017-13719 at the following links: http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html, https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf, https://seclists.org/bugtraq/2019/Jun/8.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/amcrest
- canonical/amcrest ipm-721s firmware
- version/amcrest ipm-721s firmware/amcrest_ipc-awxx_eng_n_v2.420.ac00.17.r.20170322
- canonical/amcrest ipm-721s