CVE-2019-6001 : Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and ea

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via setadapterbatteryreport command.

Published 2019-08-06 19:15:15

Updated 2019-08-16 18:49:49

Source JPCERT/CC

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Exploit prediction scoring system (EPSS) score for CVE-2019-6001

EPSS FAQ

0.65%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 80 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-6001

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
6.8	MEDIUM	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	0.9	5.9	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-6001

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-6001

Products affected by CVE-2019-6001

Canon » Eos-1d X Firmware
Versions up to, including, (<=) 2.1.0
cpe:2.3:o:canon:eos-1d_x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos-1d X » Version: N/A
Canon » Eos-1d X Mkii Firmware
Versions up to, including, (<=) 1.1.6
cpe:2.3:o:canon:eos-1d_x_mkii_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos-1d X Mkii » Version: N/A
Canon » Eos-1d C Firmware
Versions up to, including, (<=) 1.4.1
cpe:2.3:o:canon:eos-1d_c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos-1d C » Version: N/A
Canon » Eos 5d Mark Iii Firmware
Versions up to, including, (<=) 1.3.5
cpe:2.3:o:canon:eos_5d_mark_iii_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 5d Mark Iii » Version: N/A
Canon » Eos 5d Mark Iv Firmware
Versions up to, including, (<=) 1.2.0
cpe:2.3:o:canon:eos_5d_mark_iv_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 5d Mark Iv » Version: N/A
Canon » Eos 5ds Firmware
Versions up to, including, (<=) 1.1.2
cpe:2.3:o:canon:eos_5ds_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 5ds » Version: N/A
Canon » Eos 5ds R Firmware
Versions up to, including, (<=) 1.1.2
cpe:2.3:o:canon:eos_5ds_r_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 5ds R » Version: N/A
Canon » Eos 6d Firmware
Versions up to, including, (<=) 1.1.8
cpe:2.3:o:canon:eos_6d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 6d » Version: N/A
Canon » Eos 7d Mark Ii Firmware
Versions up to, including, (<=) 1.1.2
cpe:2.3:o:canon:eos_7d_mark_ii_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 7d Mark Ii » Version: N/A
Canon » Eos 70d Firmware
Versions up to, including, (<=) 1.1.2
cpe:2.3:o:canon:eos_70d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 70d » Version: N/A
Canon » Eos 80d Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_80d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 80d » Version: N/A
Canon » Eos Kiss X7i Firmware
Versions up to, including, (<=) 1.1.5
cpe:2.3:o:canon:eos_kiss_x7i_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Kiss X7i » Version: N/A
Canon » Eos D Rebel T5i Firmware
Versions up to, including, (<=) 1.1.5
cpe:2.3:o:canon:eos_d_rebel_t5i_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel T5i » Version: N/A
Canon » Eos 700d Firmware
Versions up to, including, (<=) 1.1.5
cpe:2.3:o:canon:eos_700d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 700d » Version: N/A
Canon » Eos Kiss X8i Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_kiss_x8i_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Kiss X8i » Version: N/A
Canon » Eos D Rebel T6i Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_d_rebel_t6i_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel T6i » Version: N/A
Canon » Eos 750d Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_750d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 750d » Version: N/A
Canon » Eos Kiss X9i Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_kiss_x9i_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Kiss X9i » Version: N/A
Canon » Eos D Rebel T7i Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_d_rebel_t7i_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel T7i » Version: N/A
Canon » Eos 800d Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_800d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 800d » Version: N/A
Canon » Eos Kiss X7 Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_kiss_x7_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Kiss X7 » Version: N/A
Canon » Eos D Rebel Sl1 Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_d_rebel_sl1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel Sl1 » Version: N/A
Canon » Eos 100d Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_100d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 100d » Version: N/A
Canon » Eos Kiss X9 Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_kiss_x9_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Kiss X9 » Version: N/A
Canon » Eos D Rebel Sl2 Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_d_rebel_sl2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel Sl2 » Version: N/A
Canon » Eos 200d Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_200d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 200d » Version: N/A
Canon » Eos Kiss X10 Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_kiss_x10_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Kiss X10 » Version: N/A
Canon » Eos D Rebel Sl3 Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_d_rebel_sl3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel Sl3 » Version: N/A
Canon » Eos 250d Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_250d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 250d » Version: N/A
Canon » Eos 8000d Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_8000d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 8000d » Version: N/A
Canon » Eos D Rebel T6s Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_d_rebel_t6s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel T6s » Version: N/A
Canon » Eos 760d Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_760d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 760d » Version: N/A
Canon » Eos 9000d Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_9000d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 9000d » Version: N/A
Canon » Eos 77d Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_77d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 77d » Version: N/A
Canon » Eos Kiss X70 Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_kiss_x70_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Kiss X70 » Version: N/A
Canon » Eos D Rebel T5 Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_d_rebel_t5_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel T5 » Version: N/A
Canon » Eos 1200d Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_1200d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 1200d » Version: N/A
Canon » Eos D Rebel T5 Re Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_d_rebel_t5_re_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel T5 Re » Version: N/A
Canon » Eos 1200d Mg Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_1200d_mg_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 1200d Mg » Version: N/A
Canon » Eos Hi Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_hi_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Hi » Version: N/A
Canon » Eos Kiss X80 Firmware
Versions up to, including, (<=) 1.1.0
cpe:2.3:o:canon:eos_kiss_x80_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Kiss X80 » Version: N/A
Canon » Eos D Rebel T6 Firmware
Versions up to, including, (<=) 1.1.0
cpe:2.3:o:canon:eos_d_rebel_t6_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel T6 » Version: N/A
Canon » Eos 1300d Firmware
Versions up to, including, (<=) 1.1.0
cpe:2.3:o:canon:eos_1300d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 1300d » Version: N/A
Canon » Eos Kiss X90 Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_kiss_x90_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Kiss X90 » Version: N/A
Canon » Eos D Rebel T7 Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_d_rebel_t7_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel T7 » Version: N/A
Canon » Eos 1500d Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_1500d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 1500d » Version: N/A
Canon » Eos 2000d Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_2000d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 2000d » Version: N/A
Canon » Eos D Rebel T100 Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_d_rebel_t100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos D Rebel T100 » Version: N/A
Canon » Eos 3000d Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_3000d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 3000d » Version: N/A
Canon » Eos 4000d Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_4000d_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 4000d » Version: N/A
Canon » Eos R Firmware
Versions up to, including, (<=) 1.3.0
cpe:2.3:o:canon:eos_r_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos R » Version: N/A
Canon » Eos Rp Firmware
Versions up to, including, (<=) 1.2.0
cpe:2.3:o:canon:eos_rp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Rp » Version: N/A
Canon » Eos Rp Gold Firmware
Versions up to, including, (<=) 1.2.0
cpe:2.3:o:canon:eos_rp_gold_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Rp Gold » Version: N/A
Canon » Eos M2 Firmware
Versions up to, including, (<=) 1.0.3
cpe:2.3:o:canon:eos_m2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos M2 » Version: N/A
Canon » Eos M3 Firmware
Versions up to, including, (<=) 1.2.0
cpe:2.3:o:canon:eos_m3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos M3 » Version: N/A
Canon » Eos M5 Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_m5_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos M5 » Version: N/A
Canon » Eos M6 Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:eos_m6_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos M6 » Version: N/A
Canon » Eos M6(china) Firmware
Versions up to, including, (<=) 5.0.0
cpe:2.3:o:canon:eos_m6\(china\)_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos M6(china) » Version: N/A
Canon » Eos M10 Firmware
Versions up to, including, (<=) 1.1.0
cpe:2.3:o:canon:eos_m10_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos M10 » Version: N/A
Canon » Eos M100 Firmware
Versions up to, including, (<=) 1.0.0
cpe:2.3:o:canon:eos_m100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos M100 » Version: N/A
Canon » Eos Kiss M Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_kiss_m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos Kiss M » Version: N/A
Canon » Eos M50 Firmware
Versions up to, including, (<=) 1.0.2
cpe:2.3:o:canon:eos_m50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos M50 » Version: N/A
Canon » Powershot Sx740 Hs Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:powershot_sx740_hs_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Powershot Sx740 Hs » Version: N/A
Canon » Powershot Sx70 Hs Firmware
Versions up to, including, (<=) 1.1.0
cpe:2.3:o:canon:powershot_sx70_hs_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Powershot Sx70 Hs » Version: N/A
Canon » Powershot G5xmark Ii Firmware
Versions up to, including, (<=) 1.0.1
cpe:2.3:o:canon:powershot_g5xmark_ii_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Powershot G5xmark Ii » Version: N/A
Canon » Eos 6d Mark Ii Firmware
Versions up to, including, (<=) 1.0.4
cpe:2.3:o:canon:eos_6d_mark_ii_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Canon » Eos 6d Mark Ii » Version: N/A

Vulnerability Details : CVE-2019-6001

Exploit prediction scoring system (EPSS) score for CVE-2019-6001

CVSS scores for CVE-2019-6001

CWE ids for CVE-2019-6001

References for CVE-2019-6001

Products affected by CVE-2019-6001