ONVIF Widely Used Toolkit gSOAP Vulnerability Discovered

Author: Brian Karas, Published on Jul 10, 2017

A vulnerability has been discovered in a toolkit that video surveillance manufacturers widely use for implementing ONVIF.

In this report, we examine what this vulnerability is, how it works, who is impacted, and what to do.

* ************* *** **** ********** ** * ******* **** ***** surveillance ************* ****** *** *** ************ *****.

** **** ******, ** ******* **** **** ************* **, *** it *****, *** ** ********, *** **** ** **.

[***************]

SOAP ******* *************

*** ************* ****** ** ********'* ***** *******, ***** *********** ******** **** ****. **** ***** ************ ************* implementing ***** *** ***** ** ***** ************.

******* *** ************ *** *************** ******** *.* ** *.*.**, ******:

******** *** ****** ***** ******* *.*.** ** ******* ** *** a ********* ************* **** *** ** ******* **** ***** *** specific *** ******** **** * ** ** ****.

**** ****** ******** *** ** **** ** ***** ******* ******* on *** ****** ******, ********* ******* **** ******.

*** ** *** **** **** ******* (** ******** ** **) is ******** ****** ****** ********, ***** ********* **** ** **** way ** **** ** *** ******** ** ***** ****** ** affected ******* * ************ ************.

Vulnerability **********

[****** */**/****] ****** ******** ***** ******** **** *************, ********* ****** it "*****'* ***" *** ********* ********:*****'* ***: **** ** ****** **** *****-***** **** ******* ********.

Widely **** ** *************

*******'* ***** ******* ** ****** **** *** ***** *************** ***** manufacturers, ********* ** ************* **** ***** ****. *** ******* **** could ** **** *** ***-***** ********, **** ** ** ****** a ******* ****** ******/************* ***.

Blocking ***** *******

***** *** ************* ******* ** ********* ***** ***** (*.*., ***) to ******* *** ****** ********, ** * ************ ********* **** uploads, **** ** **** *** *** ******** ***** ********, **** would ** *********. **** ** ********, *** *** ****** ****, based ** *** *** ****** **** *** ****** ****.

Manufacturer ********* ** ************* *********

**** ***** * ****** ** ******** ************* ***** **** *************. Their ********* *** *****:

  • *******: **, **** *** *** ***** *******.
  • ********: ***,******** ******** ******, *** ******* ********/***
  • ****: ***,******** * ******** ******, *** ******* ********.
  • *****: **, **** *** *** ***** *******
  • *****: ************
  • *****: ***, *** **** ** ******* *********, *** ***: ********* 2017
  • *******: **, **** *** *** ***** *******.
  • ******: **, **** *****, *** ***** ** ****** *** **** already.
  • *********: **, **** *** *** *****.
  • *********: ***, ******* *** ** **** *******. ********* ********* ***** in ************ ********* ******* ****** *****.
  • *********: **, **** *** *** ***** *******.
  • *****: **, **** *****, *** ***** ** ****** *** **** already.

*** ************* ********, ***** ****** ***** ******** ** *******/******** ******* for ***** *************, ** ** ** ******** *** *** ******** are ********, ** **** ******* ******** ** *** *** *********.

**** ***** ** ****** **** **** ********* ** ** *******.

100s ** ************* *******

***** **** *** ******* *** ** * ****** ** *** larger *************, ******** ** ********* / ************* *** ***** (***+ ONVIF ******* *** *,***+ ***** ******* * ******** ** ** this ***********). ** ******* **** ** **** *** ********.

ONVIF ************ ** *****

****** *** ***** ******* ** ***** **** ** ********* ***** functionality ** *******, *** ************* ** ******* ** *** *******, not ***** ************. ** ** **** ******** *** ************* ** implement **** ***** *********** ******* ***** **** *******. *** ***** reasons, * ******'* ***** ******* ******* ** *********** ******* *** not ** **** ** **** *** ********** ** **** *** this *************.

ONVIF ***** *** ********* ** *******

***** **** *** ********* ******* ** **** ********* ***** *** this *************:

***** ** *** **** ** *** ***** **************, *** ** SOAP ** *** **** *** *** ***** ***, ** ** possible **** ***** ***** ******* ***** ** ********. *****, *********, agreed ** **** *** * ********* ** *** ******* ** make **** ***** ** *** *************.

No ***** ** ******** ********

****** *** *** ******** *** ***** ** ******* **** *** the *******, ****** ** ****** ******** ** ** **** ** any *****-**** *******, *** **** ** * *********** ****. ******* has **** *** ******** *** ********* ** ***** ***** ********, in ***** ** **** ** **** ********* *** ********* ********* to ********** ******* *** *** ******* ***** ** ******* ***.

Low **** ** *******

*** ****** ** ****** ******** ******* ***** **** ******** ****** specific, *** *** ******* ***** *** *****, ** **** ********* of *** ****** ******, ** **** * ********** ****** **** reveals **** ** ******** **** ******. ******* ** ****, *** the **** **** *** ******* ** *** ******** *** ********** required *** ** ******* *** ***** ******** ** **** ** hard *** **** ************* **** ** *** ** **** ***.

Mitigating ****

******* ** **** ***** ***** ******** *************** ** ******* *******, restricting ******* ****** ** *** **** **** ******* ****** *** chance ** *******. ******* ********* * *** ** ******** *** remote ******, ******* ** ***** ******** ********* ** *** ********, are *********** ****** **** ****** ****** (****** ** ** ******** for *** *** ****** ** **** ***************). ************, ********* ******** to ************-*********** ********, ** **** ****** *********, **** ********* **** specific *************.

Comments (20)

Undisclosed Integrator #1

07/10/17 01:46pm

**** ***** *********** ** *** ********** *********. ***** *** *** articles **** **** *********** **** **** ***** **.

Thumbnail brk1

Brian Karas

IPVM | 07/10/17 02:18pm

****** - ** ******** * ******** **** ********* **** **** do *** *** *** ***** *******, *** ******* *** ****** accordingly.

Undisclosed #2

07/10/17 05:53pm

...***** ********* **** ** **** *** ** **** ** *** firmware ** ***** ****** ** ******** ******* * ************ ************.

******* * **** *** ** *********, ***** ** **** ********* behavior, **** *** **** **** ************* ***.

*******, ***** **** ** ******* *****, *** *** **** **** the ******* ********* *** ******** * *****, *** ****** ******* will ****** *** ******* *** *********** *** ***********.

*** ***? ******'* * ******* ** ***** ** ******* ******* help ******** ******* *** **** ** **** ** ** ******* use ** *** ********?

Thumbnail brk1

Brian Karas

IPVM | 07/10/17 06:02pm

*** ***? ******'* * ******* ** ***** ** ******* ******* help ******** ******* *** **** ** **** ** ** ******* use ** *** ********?

* ** *** ******* *** ****** ****/"***** ** *******" ******** are ***** ** ** ******** ** **** ** ******'* ****** publication.
Thumbnail me business

Scott Napier

07/11/17 02:46pm

* ** ******** *** ** **** ********, *** **** ****** know ** ****/ ******** ******** ** ******** ** ****?

Thumbnail brk1

Brian Karas

IPVM | In reply to Scott Napier | 07/11/17 09:50am

***** -

* *** ***** *** ** * ******* ** **** ** ask ***** ***** ******* ***** *** **** *** ***** **** yet. ** *** **** ******** *** ** **** *** * will ****** **** ****** **** ***** ********.

John Lineweaver

07/11/17 11:11pm

***** *** *** *** *****!

Thumbnail yelp headshot photo

Orlando Ayala

07/12/17 12:05am

***** ***** *** ****** ***** ******* **** *** ******* ***** my ***** ********** **** *****. *********, ***** ***********.

John Honovich

IPVM | In reply to Orlando Ayala | 07/12/17 12:48am

*******, ****** *** *** ******** ** *** *****. ** ********* with *** ****** ********. *** *******, **** ************** ***** ** 'Widely **** ***** ******* ************* **********'. **** ***** **** ****** generally *** ** *********** ********* ******* **'* *** ** ***** toolkit, ******* ** *****'* ****** ** ** *****'* ******. ** just ******* ** ** * ******* **** *** **** ****** used ** ********* ************ ***** ***** ***** ******** **** *** gSOAP ** * ******* *** ************ **** *******.

Thumbnail yelp headshot photo

Orlando Ayala

In reply to John Honovich | 07/12/17 04:58am

***** *****.

Undisclosed #4

07/12/17 09:14am

***** *** ***** *** **** ***** ***********. **** *** *****, it ** "*******" *** *******. ** ***** ** ********* *** some ***** **** **** ****** ** ******.

Thumbnail brk1

Brian Karas

IPVM | In reply to Undisclosed #4 | 07/12/17 10:34am

******, * ********* *** ******** ** ******* ** *** ******.

Thumbnail brk1

Brian Karas

IPVM | 07/14/17 03:55pm

******:******** ******** * ****** ** *** ***** *************, ********** **** **** ********. **** **** **** ******** ******* firmware/VMS ********.

Undisclosed #2

In reply to Brian Karas | 07/16/17 04:13pm

**** ******* *** *** ***** ****** "**** *****".

Thumbnail brk1

Brian Karas

IPVM | 07/18/17 02:50pm

******

****** ******** ***** ****** ** **** *******, ****** ** "*****'* Ivy":

*****'* ***: **** ** ****** **** *****-***** **** ******* ********

Undisclosed #2

In reply to Brian Karas | 07/18/17 03:21pm

****'* *** ********** **** ** ************ ********* *** ******* *******.

*'* *** **** *** ***** **** *******, * ******* ******* couldn't ** *********, *** ** ***** ** **** *** ******* code **** ** ************ ******* *** **** ******** *******...

Thumbnail brk1

Brian Karas

IPVM | 07/19/17 11:59am

**** **** **** ************* *** *** **** ** ***** **** newsletter:

Thumbnail profile grad864

Ryan Hulse

07/19/17 07:02pm

* ** *** ******* ******* *** ***********.

*********** **** ** ******** ******* ** ***** ** * ****** device. **** **, *********** ** *** ********* *** ****** ***** SOAP ******** **** *********** ******** ***** **** ***** ***** *** response ** ******** **** *** ****** (******* ** **** *****). To ** *********, *********** ***** **** ** **** * ******* to * ********* ******/****** ** *** ***** ******* **** ***** reply **** *** *******.

******** ************ ** **********, *********** **** ******* ** ****** ** patch *** ************* ** *** ********* *******.

Thumbnail brk1

Brian Karas

IPVM | In reply to Ryan Hulse | 07/19/17 07:10pm

**** -

****** *** *** ********** ****, * **** *** * **** for ***** **** *** ******.

Thumbnail brk1

Brian Karas

IPVM | 07/20/17 02:14pm

****** - ** ******** * ********* **** ***** **** **** use ***** *** ******** *** ******** ****/*** ******* *** *** not ********** ** ****.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

PR Campaign Exploiting Manufacturer Cybersecurity on Jul 20, 2017
Manufacturers increasingly have a bulls-eye on their back. As cyber security solutions providers grow, they realize a great way to get publicity...
Genetec Mission Control Tested on Jul 13, 2017
Genetec continues to move up market with their Mission Control, "Decision Support System", bringing PSIM-like procedures and incident management to...
ONVIF Chairman Criticizes Low Cost Cameras (Also, He Works At Axis) on Jul 12, 2017
ONVIF Chairman Per Björkdahl has taken a strong public stance against low cost cameras that are 'much more vulnerable to attack' as he explains in...
OnSSI Gets $16 Million Funding on Jul 11, 2017
OnSSI has had a rollercoaster past few years. Between acquiring VMS company Seetec, breaking up with former OEM partner Milestone and a rocky...
Universal HD Analog Encoder Tested (DW Compressor) on Jul 06, 2017
Digital Watchdog has released the Compressor HD, a "universal" HD analog encoder, with support for AHD, CVI, TVI and SD analog cameras. We tested...
H.265 / HEVC Codec Tutorial 2017 on Jun 30, 2017
For years, video surveillance professionals have talked about the potential for H.265. Now, in 2017, H.265 is starting to gain mainstream...
Hikvision H.265+ Tested on Jun 27, 2017
Hikvision, which in the past few years released H.264+ (see test results) has now released H.265+, that claims even greater bandwidth savings. We...
Milestone / Canon Launch Cloud Startup Arcus Global on Jun 27, 2017
Milestone has spun off a business, Arcus Global, funded by their parent company Canon. The new company aims to transform the VSaaS market with an...
Uniview Low-Cost Bullet PTZ Tested on Jun 21, 2017
Uniview is offering a HD zoom bullet camera, the IPC742SR9-PZ30-32G, with an integrated pan / tilt positioner, for the price of a low-cost...

Most Recent Industry Reports

Axis Door Station Tested (A8105-E) on Jul 19, 2017
Axis continues their push into niche markets, especially audio, with network speakers, an IP horn, and video door stations. We tested Axis'...
Manufacturer Favorability Guide on Jul 19, 2017
This 120 page PDF guide may be downloaded inside by all IPVM members. It covers our 20 manufacturer favorability rankings and 20 manufacturer...
$8 Billion Utility Georgia Power Enters Surveillance Business Offering Avigilon And Genetec on Jul 19, 2017
Utilities are typically considered major customers of surveillance integrators but one utility, Georgia Power, with $8+ billion in annual revenue...
Knightscope Laughs off Robot Drowning on Jul 18, 2017
A day after a Knightscope robot drowned, Knightscope has issued an 'official statement' making fun of the issue: The implied message is that...
Microsoft Video AI Cloud Services Examined on Jul 18, 2017
Microsoft has released one of the most amazing video analytics marketing videos ever. In it, they detect oil spills, track individual people giving...
Hikvision USA Head of Cybersecurity Exits on Jul 18, 2017
Hikvision USA's Head of Cybersecurity has exited the company. In this note, we review the move, share Hikvision's feedback and examine the...
'Suicidal' Knightscope Robot Drowns on Jul 17, 2017
Knightscope continues its hyper growth, at least when it comes to controversy, this time with a 'suicidal' robot in Washington DC. And here is...
March Networks Company Profile on Jul 17, 2017
March Networks was one of the most well-known video surveillance manufacturers of the 2000s. In 2012, March was acquired by Chinese / American...
Milestone Beats OnSSI In Court on Jul 17, 2017
The litigation between former partners Milestone and OnSSI has finished, confirmed by both parties. In April 2016, OnSSI sued Milestone and in...
Power For Burglar Alarms on Jul 14, 2017
In order to operate, alarm panels require the high voltages found in electrical outlets be converted to the low voltages they run on. In this...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact