Hikvision DVR DS-7204 RTSP Request Header Handling Remote Buffer Overflow Vulnerability

Bugtraq ID:	71303
Class:	Boundary Condition Error
CVE:	CVE-2014-4879
Remote:	Yes
Local:	No
Published:	Nov 19 2014 12:00AM
Updated:	Nov 19 2014 12:00AM
Credit:	Mark Schloesser
Vulnerable:	Hikvision Digital Technology DS-7204 2.2.10
Not Vulnerable:

Hikvision DVR DS-7204 RTSP Request Header Handling Remote Buffer Overflow Vulnerability

Hikvision DVR DS-7204 is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied input.

An attacker can exploit this issue to execute arbitrary code within the context of the affected device. Failed exploit attempts may result in a denial-of-service condition.

Hikvision DVR DS-7204 running firmware 2.2.10 is vulnerable; other devices may also be affected.

Hikvision DVR DS-7204 RTSP Request Header Handling Remote Buffer Overflow Vulnerability

The following proof of concept is available:

request = "PLAY rtsp://%s/ RTSP/1.0\r\n" % HOST
request += "Authorization"
request += "A" * 1024
request += ": Basic AAAAAAA\r\n\r\n"

Hikvision DVR DS-7204 RTSP Request Header Handling Remote Buffer Overflow Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Hikvision DVR DS-7204 RTSP Request Header Handling Remote Buffer Overflow Vulnerability

References:

• DS-7204 Homepage (Hikvision Digital Technology)
  
• R7-2014-18: Hikvision DVR Devices - Multiple Vulnerabilities (Rapid7)