====================================================================== 

                     Secunia Research 17/07/2012

              - Cisco Linksys PlayerPT ActiveX Control -
                  - "SetSource()" Buffer Overflow -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9

====================================================================== 
1) Affected Software 

* Cisco Linksys PlayerPT ActiveX Control 1.0.0.15

NOTE: Other versions may also be affected.

====================================================================== 
2) Severity 

Rating: Highly critical
Impact: System compromise
Where:  Remote

====================================================================== 
3) Description of Vulnerability

Secunia Research has discovered a vulnerability in Cisco Linksys 
PlayerPT ActiveX Control, which can be exploited by malicious people 
to compromise a user's system.

Cisco Linksys PlayerPT ActiveX control is bundled with the Cisco 
WVC200 Wireless-G PTZ Internet Video Camera and is used by client 
systems to view footage via Internet Explorer. The ActiveX control is 
marked safe-for-scripting and one of the provided methods is: 
"SetSource()", which is used to set the source of the footage to view.
The method accepts five string arguments where the first ("sURL") is 
the URL to the footage.

When a web page instantiates the ActiveX control and invokes the 
"SetSource()" method, the function in PlayerPT.ocx responsible for 
handling this method is called. The function performs various checks 
on the supplied arguments including a check to determine if the 
"sFrameType" string (2nd argument) is set to "mpeg". If so, the 
function searches for and strips "img/video.asf" from the provided URL
in the "sURL" argument; if not, "img/mjpeg.cgi" is used.

The URL is stored to a CString object and URLs to various resources 
are crafted based on the base URL including an URL to the 
"img/query.cgi" resource. Later, this URL is copied into a 256 byte 
stack buffer via a call to sprintf() without performing any size 
checks. This can be exploited to cause a stack-based buffer overflow 
via an overly long, specially crafted URL.

Successful exploitation allows execution of arbitrary code.

====================================================================== 
4) Solution 

According to the vendor, the ActiveX control is bundled only with 
products considered EOL and, therefore, itself considered EOL. The 
vendor is currently working on getting the kill-bit set.

As a workaround, set the kill-bit for the following CLSID:
* {9E065E4A-BD9D-4547-8F90-985DC62A5591}

====================================================================== 
5) Time Table 

23/03/2012 - Vulnerability discovered while analysing public report of 
             similar vulnerability (SA48543#1).
23/03/2012 - Vendor notified.
02/04/2012 - Vendor response (WVC200 product bundling the ActiveX 
             control has become EOL).
03/04/2012 - Vendor informed that ActiveX control should have kill-bit 
             set if considered EOL and asked to confirm that no 
             currently supported products bundle it.
13/04/2012 - Status update requested.
15/04/2012 - Vendor response (currently checking which products bundle
             the ActiveX control and looking into setting kill-bit).
21/06/2012 - Status update requested.
13/07/2012 - Status update requested.
13/07/2012 - Vendor response (determined that no supported products 
             bundle the vulnerable ActiveX control and looking into 
             setting kill-bit).
17/07/2012 - Public disclosure.

====================================================================== 
6) Credits 

Discovered by Carsten Eiram, Secunia Research.

====================================================================== 
7) References

The Common Vulnerabilities and Exposures (CVE) project has assigned 
CVE-2012-0284 for the vulnerability.

====================================================================== 
8) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private 
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the 
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

====================================================================== 
9) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2012-25/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================