exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

vcs100.txt

vcs100.txt
Posted Jul 2, 2005
Authored by Donato Ferrante | Site autistici.org

Video Cam Server version 1.0.0 is susceptible to a directory traversal attack.

tags | exploit
SHA-256 | ada3a5328ddaa14bdc136ad11e095dc6ab58a6c24f3b0f31394aa705cb84dc7d

vcs100.txt

Change Mirror Download

Donato Ferrante


Application: Video Cam Server
http://vcs.raybase.com/

Version: 1.0.0

Bugs: Multiple Vulnerabilities

Date: 02-May-2005

Author: Donato Ferrante
e-mail: fdonato@autistici.org
web: www.autistici.org/fdonato



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1. Description
2. The bugs
3. The code
4. The fix



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

----------------
1. Description:
----------------

Vendor's Description:

"Video Cam Server (VCS) is a server for publishing the image taken from
a Video Camera (especially Web Cam) connected to it. It will be very
useful for remote monitoring your home, office or other environment."



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

-------------
2. The bugs:
-------------

The bugs are located into the built-in webserver.
By default no HTTP Authentication is set so a malicious user can:

i.
(path disclosure) know the remote current path, by sending an
http request for an unavailable page.

ii.
(directory traversal) go out the document root assigned to the
webserver by using common malicious patterns like: ".." into
http requests, and see/download all the files available on the
remote system.

iii.
(denial of service) shutdown http-server and/or camera, by using
admin's control page that it's not properly managed.


NOTE:

Reported vulnerabilities are also valid if the HTTP Authentication is
set, but in this case the malicious user must obtain login information.



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

-------------
3. The code:
-------------

To test the vulnerabilities:

i.
http://[host]/%20


ii.
http://[host]/..\..\..\..\..\..\..\..\..\..\..\windows\system.ini

or connect to the webserver and send a raw request like:

GET /../../../../../../../../../../../windows/system.ini HTTP/1.1


iii.
http://[host]/admin.html



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

------------
4. The fix:
------------

Vendor has been notified.
Bugs will be probably fixed in the next release.



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Login or Register to add favorites

File Archive:

February 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    16 Files
  • 2
    Feb 2nd
    19 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    2 Files
  • 7
    Feb 7th
    10 Files
  • 8
    Feb 8th
    25 Files
  • 9
    Feb 9th
    37 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    20 Files
  • 14
    Feb 14th
    25 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    6 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    35 Files
  • 20
    Feb 20th
    25 Files
  • 21
    Feb 21st
    18 Files
  • 22
    Feb 22nd
    15 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    10 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close