Detections
Analytics

Lorex Technologies Edge Series Security DVR ActiveX Buffer Overflow

critical Nessus Plugin ID 72264

Language:

Synopsis

The remote Windows host has one or more ActiveX controls installed that are affected by a buffer overflow vulnerability.

Description

The remote Windows host has one or more versions of Lorex Technologies' INetViewX ActiveX control installed. The HTTP_PORT parameter in these controls is affected by a buffer overflow vulnerability that could allow an attacker to remotely execute arbitrary code if exploited.

Solution

There are currently no fixes available but as a workaround, set the kill bit on the affected ActiveX controls.

See Also

https://seclists.org/fulldisclosure/2014/Jan/41

Plugin Details

Severity: Critical

ID: 72264

File Name: lorex_edge_activex_bof_cve-2014-1201.nasl

Version: 1.10

Type: local

Agent: windows

Family: Windows

Published: 2/3/2014

Updated: 11/26/2019

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.6

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2014-1201

Vulnerability Information

CPE: cpe:/a:lorex_technology:edge%2b_lh320_firmware, cpe:/a:lorex_technology:edge2_lh330_firmware, cpe:/a:lorex_technology:edge3_lh340_firmware, cpe:/a:lorex_technology:edge_lh310_firmware

Required KB Items: SMB/Registry/Enumerated, SMB/WindowsVersion

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/9/2014

Exploitable With

CANVAS (D2ExploitPack)

Reference Information

CVE: CVE-2014-1201

BID: 64783