Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.

Security fix for CVE-2017-9765.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gsoap fixes the following security issue :

  - CVE-2017-9765: A remote attacker may have triggered a     buffer overflow to cause a server crash (denial of     service) after sending 2GB of a specially crafted XML     message, or possibly have unspecified futher impact.
    (bsc#1049348)

Senrio reports :

Genivia gSOAP is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.

A remote attacker may exploit this issue to execute arbitrary code in the context of the affected device. Failed attempts will likely cause a denial-of-service condition.

A vulnerability was discovered in gsoap, a library for the development of SOAP web services and clients, that may be exposed with a large and specific XML message over 2 GB in size. After receiving this 2 GB message, a buffer overflow can cause an open unsecured server to crash. Clients communicating with HTTPS with trusted servers are not affected.

For Debian 7 'Wheezy', these problems have been fixed in version 2.8.7-2+deb7u1.

We recommend that you upgrade your gsoap packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is vulnerable to a flaw which allows a remote attacker to control the system. The flaw, nicknamed Devil's Ivy stems from a buffer overflow in the gSoap component.

The remote AXIS device is running a firmware version that is missing a security patch. It is, therefore, affected by a remote code execution vulnerability, known as Devil's Ivy, due to an overflow condition that exists in a third party SOAP library (gSOAP). An unauthenticated, remote attacker can exploit this, via an HTTP POST message exceeding 2GB of data, to trigger a stack-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code.

An attacker who successfully exploits this vulnerability can reset the device to its factory defaults, change network settings, take complete control of the device, or reboot it to prevent an operator from viewing the feed.

ID	Name	Product	Family	Severity
102407	Fedora 25 : gsoap (2017-ff06ff0ec9) (Devil's Ivy)	Nessus	Fedora Local Security Checks	high
102404	Fedora 26 : gsoap (2017-d2174c28ed) (Devil's Ivy)	Nessus	Fedora Local Security Checks	high
102011	openSUSE Security Update : gsoap (openSUSE-2017-842) (Devil's Ivy)	Nessus	SuSE Local Security Checks	high
101967	FreeBSD : gsoap -- remote code execution via via overflow (8745c67e-7dd1-4165-96e2-fcf9da2dc5b5) (Devil's Ivy)	Nessus	FreeBSD Local Security Checks	high
101935	Debian DLA-1036-1 : gsoap security update (Devil's Ivy)	Nessus	Debian Local Security Checks	high
7279	Axis Camera Multiple Products RCE (Devil's Ivy)	Nessus Network Monitor	IoT	high
101810	AXIS gSOAP Message Handling RCE (ACV-116267) (Devil's Ivy)	Nessus	Misc.	high

Detections

Analytics

CVE-2017-9765

high

Tenable Plugins

high

high

high

high

high

high

high