PT-2014-5601 · Samsung · Samsung Ipolis Device Manager

Andrea Micalizzi + 3 · Publicado 2014-06-04 · Atualizado 2014-06-06 · CVE-2014-3912

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Samsung iPOLiS Device Manager versions prior to 1.8.7

Description The issue is related to a stack-based buffer overflow in the FindConfigChildeKeyList method of the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control. This allows remote attackers to execute arbitrary code via a long value. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations For versions prior to 1.8.7, update to version 1.8.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control until the update is applied.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2014-3912

ZDI-14-169

Produtos afetados

Samsung Ipolis Device Manager

Referências · 4

• https://zerodayinitiative.com/advisories/ZDI-14-169 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-3912 · Nota de Segurança
• http://securityfocus.com/bid/67823 · Nota
• http://zerodayinitiative.com/advisories/ZDI-14-169 · Correção