OS 1.3.1 (Albatross) release notes

Our OS is a standardized operating system for IP cameras that include a supported system on a chip (SoC). It is based on the Android Open Source Project (AOSP) and has been customized for use in embedded devices by our hardware partners. It includes our APIs and OS components.

Our new release OS 1.3.1 has a certain number of improvements and fixes included.

• New: Support of PTZ (pan-tilt-zoom) cameras

User DB

• New: Administrator can force user to reset password at next login
• Changed: Default user in user DB removed
• Changed: User permission FACTORY_RESET is required to trigger a factory reset.
• Changed: User permissions DEVELOPER_MODE and FACTORY_RESET are required to enable developer mode.
• Changed: Password strength is now checked
• Changed: Database is encrypted

Videopipeline

• New: Feature "base camera" - 180 degrees image rotation for cameras mounted upside down
• Fixed: Memory leak in CameraTexture::UpdateTextureImage()
• Fixed: Apps no longer crash in _requestVideoSession()_ when the image is rotated in the Camera Settings
• Fixed: Error handling for video sessions requested with same surface is now fixed

Webserver

• Fixed: Potential XSS attack or redirect to another page fixed via login referrer

OnvifServer

• Changed: App management complaint with latest ONVIF specifications

Media service

• Changed: Now wraps the MetadataStream payload with a header, according to OSSA spec 1.1

HealthService

• Fixed: Memory consumption can no longer become negative
• Fixed: App stopping will no longer be counted as a kill
• Fixed: Crashes in native code will no longer go undetected

WebUI

• New: Users can now change their password (via user icon)
• New: WebUI page for connecting to a WiFi network
• Changed: Azena logo updated
• Changed: User Management page is not visible in sidebar when user does not have UserManagement permission
• Changed: The WebUI pages now support co-branding of Vendor and Azena

APIs

• Changed: APIs adjusted to support new features: PTZ (see above), ImageRotation (see above under Videopipeline) and configuring camera before requesting capture

Security

List of fixed issues

• Video session rate is limited to prevent DoS
• Cross site request forgery(XSRF) is blocked
• UserDB is fully encrypted
• Brute force protection is fixed
• Device Certificates are protected and cannot be resigned
• Firmware manager allows only signed firmware for OTA update
• CVEs patched from Android Security Bulletin:
  • CVE-2018-9555
  • CVE-2018-9527
  • CVE-2018-9504
  • CVE-2018-9476
  • CVE-2017-13283
  • CVE-2018-9498
  • CVE-2018-9497
  • CVE-2018-9490
  • CVE-2018-9583
  • CVE-2019-1991
  • CVE-2019-1992