PT-2014-5601 · Samsung · Samsung Ipolis Device Manager

Andrea Micalizzi + 3 · Published 2014-06-04 · Updated 2014-06-06 · CVE-2014-3912

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Samsung iPOLiS Device Manager versions prior to 1.8.7

Description The issue is related to a stack-based buffer overflow in the FindConfigChildeKeyList method of the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control. This allows remote attackers to execute arbitrary code via a long value. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations For versions prior to 1.8.7, update to version 1.8.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control until the update is applied.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-3912

ZDI-14-169

Affected Products

Samsung Ipolis Device Manager

References · 4

• https://zerodayinitiative.com/advisories/ZDI-14-169 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-3912 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-14-169 · Patch
• http://securityfocus.com/bid/67823 · Note