PT-2019-17930 · Canon · Canon Eos 9000D+32

Published 2019-08-06 · Updated 2019-08-16 · CVE-2019-6001

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Canon EOS series digital cameras versions 1.0.0 through 2.1.0 Canon EOS-1D X firmware version 2.1.0 and earlier Canon EOS-1D X MKII firmware version 1.1.6 and earlier Canon EOS-1D C firmware version 1.4.1 and earlier Canon EOS 5D MARK III firmware version 1.3.5 and earlier Canon EOS 5D MARK IV firmware version 1.2.0 and earlier Canon EOS 5DS firmware version 1.1.2 and earlier Canon EOS 5DS R firmware version 1.1.2 and earlier Canon EOS 6D firmware version 1.1.8 and earlier Canon EOS 6D MARK II firmware version 1.0.4 and earlier Canon EOS 7D MARK II firmware version 1.1.2 and earlier Canon EOS 70 D firmware version 1.1.2 and earlier Canon EOS 80 D firmware version 1.0.2 and earlier Canon EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier Canon EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier Canon EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier Canon EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier Canon EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier Canon EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier Canon EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier Canon EOS 9000D / EOS 77D firmware version 1.0.2 and earlier Canon EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier Canon EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier Canon EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier Canon EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier Canon EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier Canon EOS R firmware version 1.3.0 and earlier Canon EOS RP firmware version 1.2.0 and earlier Canon EOS RP GOLD firmware version 1.2.0 and earlier Canon EOS M2 firmware version 1.0.3 and earlier Canon EOS M3 firmware version 1.2.0 and earlier Canon EOS M5 firmware version 1.0.1 and earlier Canon EOS M6 firmware version 1.0.1 and earlier Canon EOS M6(China) firmware version 5.0.0 and earlier Canon EOS M10 firmware version 1.1.0 and earlier Canon EOS M100 firmware version 1.0.0 and earlier Canon EOS KISS M / EOS M50 firmware version 1.0.2 and earlier Canon PowerShot SX740 HS firmware version 1.0.1 and earlier Canon PowerShot SX70 HS firmware version 1.1.0 and earlier Canon PowerShot G5Xmark II firmware version 1.0.1 and earlier

Description A buffer overflow in the PTP (Picture Transfer Protocol) of Canon EOS series digital cameras and PowerShot cameras allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via the setadapterbatteryreport command.

Recommendations For each of the affected firmware versions, update to a version later than the one specified to resolve the issue. As a temporary workaround, consider disabling the PTP protocol until a patch is available. Restrict access to the network segment where the affected cameras are located to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2019-6001

Affected Products

Canon Eos 5D Mark Iii

Canon Eos 5Ds

Canon Eos 6D

Canon Eos 6D Mark Ii

Canon Eos 70 D

Canon Eos 7D Mark Ii

Canon Eos 80 D

Canon Eos 8000D

Canon Eos 9000D

Canon Eos D Rebel T100

Canon Eos D Rebel T5 Re

Canon Eos Kiss M

Canon Eos Kiss X10

Canon Eos Kiss X7I

Canon Eos Kiss X70

Canon Eos Kiss X80

Canon Eos Kiss X8I

Canon Eos Kiss X9I

Canon Eos Kiss X90

Canon Eos M10

Canon Eos M100

Canon Eos M2

Canon Eos M3

Canon Eos M5

Canon Eos M6

Canon Eos R

Canon Eos Rp Gold

Canon Eos Series

Canon Eos-1D X

Canon Eos-1D X Mkii

Canon Powershot G5Xmark Ii

Canon Powershot Sx70 Hs

Canon Powershot Sx740 Hs

References · 7

• 🔥 https://research.checkpoint.com/say-cheese-ransomware-ing-a-dslr-camera · Exploit
• https://cweb.canon.jp/e-support/products/eos-d/190806dilc-firm.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6001 · Security Note
• https://usa.canon.com/internet/portal/us/home/support/product-advisories/detail/the-vulnerability-in-canon-digital-cameras · Vendor Advisory
• https://canon-europe.com/support/product-security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6001 · Vendor Advisory
• http://jvn.jp/en/vu/JVNVU97511331/index.html · Note