Description
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ZoneMinder zoneminder
Default version status: unaffected
0 to < 1.38.4affected1.38.4unaffected
pkg:github/ZoneMinder/zoneminderReferences
- https://github.com/ZoneMinder/zoneminder/commit/2596e5fb64c0348e615577b0ab08dc38b6dc6ed8 ↗
- https://github.com/ZoneMinder/zoneminder ↗
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-93j4-rcp9-9jx6 ↗
- https://github.com/ZoneMinder/zoneminder/commit/813bf6f1a3ffc92c163352f2480477ba571fca5b ↗
- https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4 ↗
- https://github.com/ZoneMinder/zoneminder/blob/1.38.3/src/zm_remote_camera_http.cpp#L736 ↗
- https://www.vulncheck.com/advisories/zoneminder-before-1.38.4-buffer-overflow-via-http-camera-response ↗