|
Axis Products DNS Implementation Denial of Service Vulnerability
|
|
Secunia Advisory:
|
SA13145
|
|
|
Release Date:
|
2004-11-09
|
|
Popularity:
|
5,713 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
DoS
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Axis Network Camera
Axis Network DVR
Axis Network Video Server
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2004-0789
|
|
Description:
Roy Arends and Jakob Schlyter has reported a vulnerability in various Axis products, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to a design error within the DNS protocol implementation, which allows a DNS response to be answered with a DNS response. This can be exploited by sending a DNS request (either spoofed to originate from port 53/UDP on another vulnerable device or from the device itself) to a vulnerable device, which will cause DNS messages to bounce back and forth in an infinite loop.
Successful exploitation may consume a large amount of system and network resources.
The vulnerability affects the following products:
* Axis 2400+ Network Video Server
* Axis 2401+ Network Video Server
* Axis 2460 Network DVR
* Axis 2100 Network Camera
* Axis 2110 Network Camera
* Axis 2120 Network Camera
* Axis 2420 Network Camera
Solution:
Updated firmware releases are available at:
http://www.axis.com/techsup/firmware.php?value=camserver
Provided and/or discovered by:
Roy Arends and Jakob Schlyter
Original Advisory:
NISCC:
http://www.uniras.gov.uk/vuls/2004/758884/index.htm
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
