PT-2014-8714 · Panasonic · Panasonic Network Camera Recorder

Andrea Micalizzi + 1 · Published 2014-10-14 · Updated 2021-11-09 · CVE-2014-8756

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Panasonic Network Camera Recorder versions prior to 4.04R03

Description The issue allows remote attackers to execute arbitrary code via a crafted GetVOLHeader method call, which writes null bytes to an arbitrary address. This is related to the NcrCtl4.NcrNet.1 control in the Panasonic Network Camera Recorder.

Recommendations For versions prior to 4.04R03, update to version 4.04R03 or later to resolve the issue. As a temporary workaround, consider restricting access to the GetVOLHeader method until a patch is applied.

Fix

Related Identifiers

CVE-2014-8756

ZDI-14-363

Affected Products

Panasonic Network Camera Recorder

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-8756 · Security Note
• http://panasonic.net/pcc/cgi-bin/products/netwkcam/download_us/tbookmarka_m.cgi?m=%20&mm=2010073014092324 · Patch
• https://zerodayinitiative.com/advisories/ZDI-14-363 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-14-363 · Note