Vulnerability Description
An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long "callbackUrl" value in order to exploit this vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samsung | Sth-Eth-250 Firmware | 0.20.17 |
| Samsung | Sth-Eth-250 | - |
Related Weaknesses (CWE)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0570ExploitThird Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0570ExploitThird Party Advisory
FAQ
What is CVE-2018-3897?
CVE-2018-3897 is a vulnerability with a CVSS score of 8.8 (HIGH). An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process inc...
How severe is CVE-2018-3897?
CVE-2018-3897 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-3897?
Check the references section above for vendor advisories and patch information. Affected products include: Samsung Sth-Eth-250 Firmware, Samsung Sth-Eth-250.