Stack-based buffer overflow in ZoneMinder - #VU158960

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code in the zmc capture daemon.

The vulnerability exists due to stack-based buffer overflows in RtspThread::Run() in src/zm_rtsp.cpp when parsing RTSP handshake responses and RTSP-over-HTTP tunnel responses with unbounded sscanf conversions. A remote attacker can supply an oversized Public or Transport response header or HTTP status text through a malicious or compromised RTSP server or a man-in-the-middle position to overflow 256-byte stack buffers, crash the capture daemon, and potentially execute arbitrary code in its context.

Affected software

Remediation

External References

• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-xp4c-29hh-2w4j

Related Security Bulletins

• Multiple vulnerabilities in ZoneMinder