PT-2022-12686 · Unknown · Iipimage High Resolution Streaming Image Server

Published 2022-02-07 · Updated 2022-02-11 · CVE-2021-46389

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IIPImage High Resolution Streaming Image Server versions prior to commit 882925b295a80ec992063deffc2a3b0d803c3195

Description The issue is caused by an integer overflow in iipsrv.fcgi through malformed HTTP query parameters. This can be exploited by sending specifically crafted requests to the server.

Recommendations For versions prior to commit 882925b295a80ec992063deffc2a3b0d803c3195, update to a version that includes the fix for the integer overflow in iipsrv.fcgi. As a temporary workaround, consider restricting access to the iipsrv.fcgi module to minimize the risk of exploitation.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2021-46389

Affected Products

Iipimage High Resolution Streaming Image Server

References · 7

• https://github.com/ruven/iipsrv/commit/4ed59265fbbd636dc2fbbf325f8ea37ed300a6d9 · Patch
• https://github.com/ruven/iipsrv/commit/882925b295a80ec992063deffc2a3b0d803c3195 · Patch
• https://osv.dev/vulnerability/CVE-2021-46389 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46389 · Security Note
• https://t.me/cvenotify/26608 · Telegram Post
• https://t.me/cibsecurity/36934 · Telegram Post
• https://t.me/cvenotify/26359 · Telegram Post