Samsung SmartThings Hub STH-ETH-250 0.20.17 Video-Core Process /cameras/XXXX/clips HTTP Request memory corruption

Summaryinfo

A vulnerability was found in Samsung SmartThings Hub STH-ETH-250 0.20.17. It has been rated as critical. This vulnerability affects unknown code of the file /cameras/XXXX/clips of the component Video-Core Process. Performing a manipulation as part of HTTP Request results in memory corruption. This vulnerability is identified as CVE-2018-3893. The attack can be initiated remotely. There is not any exploit available. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability classified as critical has been found in Samsung SmartThings Hub STH-ETH-250 0.20.17 (Router Operating System). This affects an unknown function of the file /cameras/XXXX/clips of the component Video-Core Process. The manipulation as part of a HTTP Request leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.

The bug was discovered 07/26/2018. The weakness was released 08/27/2018 (Website). It is possible to read the advisory at talosintelligence.com. This vulnerability is uniquely identified as CVE-2018-3893 since 01/01/2018. The exploitability is told to be easy. It is possible to initiate the attack remotely. The successful exploitation requires a authentication. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 32 days. During that time the estimated underground price was around $0-$5k.

It is possible to mitigate the weakness by firewalling .

Entries connected to this vulnerability are available at VDB-123345, VDB-123812, VDB-123813 and VDB-124391. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Samsung

Name

• SmartThings Hub STH-ETH-250

Version

• 0.20.17

License

• open-source

Website

• Vendor: https://www.samsung.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion