----------------------------------------------------------------------

Want a new IT Security job?

Vacant positions at Secunia:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
GeoVision Digital Video Surveillance System Authentication Bypass

SECUNIA ADVISORY ID:
SA15330

VERIFY ADVISORY:
http://secunia.com/advisories/15330/

CRITICAL:
Moderately critical

IMPACT:
Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
GeoVision Digital Video Surveillance System 6.x
http://secunia.com/product/5076/
GeoVision Digital Video Surveillance System 7.x
http://secunia.com/product/5077/

DESCRIPTION:
Tirath Rai has reported a security issue in GeoVision Digital Video
Surveillance System, which can be exploited by malicious people to
disclose sensitive information.

The problem is that images can be accessed directly via the JPEG
Image Viewer. This can be exploited to disclose images from e.g.
security cameras without supplying a password.

Successful exploitation requires that the system is configured to
create JPEG images.

The security issue has been reported in versions 6.04, 6.1, and 7.0.
Other versions may also be affected.

SOLUTION:
Enable the "Enhanced Network Security" feature introduced in version
7.0 (not enabled per default).

PROVIDED AND/OR DISCOVERED BY:
Tirath Rai, Esqo.

ORIGINAL ADVISORY:
http://www.esqo.com/research/advisories/2005/100505-1.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------