Buffer Overflow Vulnerabilities in Samsung SmartThings Hub from Video-Core HTTP Server

CVE-2018-3878

Summary

Multiple exploitable buffer overflow vulnerabilities have been identified in the credentials handler of the video-core's HTTP server in Samsung SmartThings Hub STH-ETH-250 devices running firmware version 0.20.17. This issue arises from improper extraction of fields from a user-controlled JSON payload, allowing for a stack buffer overflow. In particular, a vulnerable strncpy function can cause a buffer overflow on the destination buffer, which has a limited size of just 16 bytes. By sending an excessively long 'region' value, an attacker can exploit this vulnerability, potentially leading to arbitrary code execution or other security breaches.

References