Ege Balci

An issue exists when parsing specially crafted PNG images containing malformed color profile metadata. The application fails to validate chunk boundaries while searching for a null terminator, which can cause the application to read past the allocated buffer if a user opens a malicious image. This can result in a Denial of Service (DoS) via an application crash or the potential exposure of sensitive memory contents.

The web-management application on the affected devices allows OS command injection via `mv backend launch` in `cirrus/application/helpers/mv backend helper.php` by leveraging the "start" state and sending a `check device name` request.

An issue in rsync allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories, for example, overwrite the .ssh/authorized keys file.

The issue concerns broken access control in the devices, allowing attackers to download sensitive files without authentication. Specifically, attackers can access `/updownload/t.report` (also known as Log & Report) files and backup files via `download.php`. These backup files contain user credentials and configuration information for the camera device. An attacker can discover the backup filename by reading system logs or report data, or by brute-forcing the backup filename pattern. This could potentially allow an attacker to authenticate to the admin account using the admin password.

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this issue to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.