PT-2019-17929 · Canon · Canon Powershot Sx70 Hs+3

Published 2019-08-06 · Updated 2020-08-24 · CVE-2019-6000

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Canon EOS series digital cameras versions 1.0.0 through 2.1.0 Canon PowerShot SX740 HS version 1.0.1 Canon PowerShot SX70 HS version 1.1.0 Canon PowerShot G5Xmark II version 1.0.1

Description A buffer overflow issue exists in the PTP (Picture Transfer Protocol) of the affected Canon products. This issue allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via the sendhostinfo command.

Recommendations For Canon EOS series digital cameras, update the firmware to a version later than 2.1.0. For Canon PowerShot SX740 HS, update the firmware to a version later than 1.0.1. For Canon PowerShot SX70 HS, update the firmware to a version later than 1.1.0. For Canon PowerShot G5Xmark II, update the firmware to a version later than 1.0.1. As a temporary workaround, consider restricting access to the sendhostinfo command until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-6000

Affected Products

Canon Eos Series

Canon Powershot G5Xmark Ii

Canon Powershot Sx70 Hs

Canon Powershot Sx740 Hs

References · 7

• 🔥 https://research.checkpoint.com/say-cheese-ransomware-ing-a-dslr-camera · Exploit
• https://osv.dev/vulnerability/CVE-2019-6000 · Vendor Advisory
• https://cweb.canon.jp/e-support/products/eos-d/190806dilc-firm.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6000 · Security Note
• https://usa.canon.com/internet/portal/us/home/support/product-advisories/detail/the-vulnerability-in-canon-digital-cameras · Vendor Advisory
• https://canon-europe.com/support/product-security · Vendor Advisory
• http://jvn.jp/en/vu/JVNVU97511331/index.html · Note