Technical Description

A vulnerability has been identified in AXIS Camera Control, which could be exploited by remote attackers to cause a denial of service or take complete control of an affected system. This issue is caused by a buffer overflow error in the CamImage.CamImage.1 ActiveX control (AxisCamControl.ocx) when handling an overly long argument passed as the "image_pan_tilt" property, which could be exploited by remote attackers to execute arbitrary code by tricking a user into visiting and clicking a specially crafted web page.

Affected Products

AXIS Camera Control version 2.40.0.0 and prior

Solution

Reportedly, the vendor recommends removing the ActiveX control and using AXIS Media Control as a replacement :
http://www.axis.com/techsup/software/amc/index.htm

References

http://www.vupen.com/english/advisories/2009/0228
http://www.axis.com/techsup/software/acc/files/acc_security_update_090119.pdf
http://secunia.com/secunia_research/2008-58/

Credits

Vulnerability reported by Alin Rad Pop (Secunia Research).

ChangeLog

2009-01-26 : Initial release
2009-01-27 : Updated Severity Rating

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.