Stack-based buffer overflow in ZoneMinder - #VU158954

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the ZoneMinder server.

The vulnerability exists due to a stack-based buffer overflow in SessionDescriptor::generateFormatContext() in src/zm_sdp.cpp when parsing an SDP response during RTSP DESCRIBE processing. A remote attacker can supply an oversized sprop-parameter-sets value through a malicious configured RTSP camera or a man-in-the-middle attack on the camera network, causing strcpy() to copy the value into a 1024-byte stack buffer without bounds checking and overwrite the saved frame pointer and return address to execute arbitrary code.

Affected software

Remediation

External References

• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-wg5h-vcgv-74pv

Related Security Bulletins

• Multiple vulnerabilities in ZoneMinder