Some vulnerabilities have been discovered in Motion, which potentially can be exploited by malicious people to compromise a vulnerable system.

1) An off-by-one error within the "read_client()" function in webhttpd.c can be exploited to cause a stack-based buffer overflow with a zero-byte by sending an overly long request to a vulnerable Motion HTTP control interface.

Successful exploitation may allow execution of arbitrary code, but requires that the HTTP Control interface is enabled.

The vulnerability is reported in versions 3.2.10 and prior.

2) A boundary error within the "read_client()" function in webhttpd.c can be exploited to cause a stack-based buffer overflow by sending a specially crafted request to the HTTP control interface

Successful exploitation allows execution of arbitrary code, but requires that the HTTP Control interface is enabled.

The vulnerability is confirmed in version 3.2.10.

Solution
Update to version 3.2.10.1.

Provided and/or discovered by
1) Nico Golde
2) Stefan Cornelius, Secunia Research

Changelog
Further details available to Secunia VIM customers

Original Advisory
1) Debian Bug #484572:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484572

2) http://secunia.com/secunia_research/2008-26/

Deep Links
Links available to Secunia VIM customers