A dangerous Sony Bravia TV vulnerability has been found to affect several of the popular models of the range. The security researchers that alerted of the issue note that a series of other bugs were found as well. Our articles gives an overview of the problems and how they affect the Sony Bravia TV models.
CVE-2018-16593 Is The Main Sony Bravia TV vulnerability
A team of security researchers uncovered several dangerous bugs in the Sony Bravia TV range that affect some of their most popular models. The list of affected models is the following: R5C, WD75, WD65, XE70, XF70, WE75, WE6 and WF6.
According to the released information the most dangerous bug of all is the critical vulnerability tracked in the CVE-2018-16593 advisory. It is a command-injection bug that has been found in the Photo Sharing Plus application found on the devices which allows users to share various multimedia content from their mobile devices to the TVs. In order to exploit this bug the attackers will need to be connected to the same Wi-Fi network as the target device.
The problem lies within the application itself which handles file names in an incorrect way when the users upload the media file. This can lead to a situation where the attackers can abuse this vulnerability in order to execute arbitrary commands. This can result in a complete take over over of the system by causing a remote code execution with acquired root privileges.
The other bug found by the security team is a stack buffer overflow issue tracked in a separate advisory known known as CVE-2018-16595. The description of the vulnerability shows that this is a memory corruption bug that is caused by an insufficient size checking of the user input. It effectively allows hackers to crash the application by sending a long HTTP POST network request.
The third bug is caused by an incorrect handling of the file names when they are uploaded through an URL address and tracked in the CVE-2018-16594 advisory. To facilitate this bug the hackers will need to upload an arbitrary file with a crafted file name according to the weaknesses.
Sony has already issued patches for the vulnerabilities, all users who have not updated their Bravia TV sets should initiate them as soon as possible!
Martin Beltov
Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.
Follow Me: