CVE-2019-5460

A vendor fix is available.

• FixedAbility Camera Connectabb_psirt

  The problem is corrected in the following product versions: ABB Ability Camera Connect 1.5.0.15 The 3rd party component has already been updated. The easiest path to mitigate the problem is an update of just VLC Media Player by the customer. ABB recommends that customers apply the update at earliest convenience. It is also possible to update to the latest Version of Camera Connect.

• FixedAbility Camera Connectcisa_csaf_ot

  The problem is corrected in the following product versions: ABB Ability Camera Connect 1.5.0.15 The 3rd party component has already been updated. The easiest path to mitigate the problem is an update of just VLC Media Player by the customer. ABB recommends that customers apply the update at earliest convenience. It is also possible to update to the latest Version of Camera Connect.

• MitigationAbility Camera Connectabb_psirt

  • No exposure to malicious ASF files: The exploit requires a specially crafted ASF file. In con-trolled environments without external media sources, such files cannot be introduced. • Remote attack vector eliminated: The vulnerability’s CVSS vector indicates a network-based attack scenario, which is impossible without connectivity. • Strict operational controls: Media ingestion is limited to trusted sources under administrative supervision, further minimizing the likelihood of malicious file introduction. • Effective risk reduction: These combined factors render exploitation highly improbable, neutralizing the buffer overflow threat.

• MitigationAbility Camera Connectcisa_csaf_ot

  • No exposure to malicious ASF files: The exploit requires a specially crafted ASF file. In con-trolled environments without external media sources, such files cannot be introduced. • Remote attack vector eliminated: The vulnerability’s CVSS vector indicates a network-based attack scenario, which is impossible without connectivity. • Strict operational controls: Media ingestion is limited to trusted sources under administrative supervision, further minimizing the likelihood of malicious file introduction. • Effective risk reduction: These combined factors render exploitation highly improbable, neutralizing the buffer overflow threat.