PDA

Bekijk Volledige Versie : Re: [Full-Disclosure] [PoC] Nasty bug(s) found in Axis Network Camera/Video Servers


morning_wood
24/08/04, 20:55
password issues known to exist..

http://www.google.com/search?hl=en&lr=&ie=UTF-8&newwindow=1&safe=off&q=axis+camera+exploit

http://www.google.com/search?hl=en&lr=&ie=UTF-8&newwindow=1&safe=off&q=axis+camera+vulnerability

or...
http://www2.corest.com/common/showdoc.php?idx=329&idxseccion=10
http://www.securityfocus.com/bid/3640/exploit/

>To: security@axis.com
>Date: Mon, 16 Aug 2004 22:48:38 +0200 (CEST)

try the contact page?
http://www.axis.com/corporate/contact.htm



err...

m.w
bashis
26/08/04, 17:45
> Vendor,
> Contacted:
> >To: security@axis.com
> >Date: Mon, 16 Aug 2004 22:48:38 +0200 (CEST)
>
> Status: No responce what so ever.

Received ack from Axis today, 24 Aug 2004 08:32:50.0435 (UTC)

Have a nice day
/bashis
bashis
28/08/04, 02:45
> password issues known to exist..
Yes.

> http://www.google.com/search?hl=en&lr=&ie=UTF-8&newwindow=1&safe=off&q=axis+camera+exploit
>
> http://www.google.com/search?hl=en&lr=&ie=UTF-8&newwindow=1&safe=off&q=axis+camera+vulnerability
>
> or...
> http://www2.corest.com/common/showdoc.php?idx=329&idxseccion=10
> http://www.securityfocus.com/bid/3640/exploit/
Not the same stuff..

'axis-wh00t.sh' adding a new user 'wh00t' with password 'wh00t' with Admin
priviliges, as anonymous viewer. No matter what password root have.

Read it, try it, understand it, before useless postings..

> >To: security@axis.com
> >Date: Mon, 16 Aug 2004 22:48:38 +0200 (CEST)
>
> try the contact page?
> http://www.axis.com/corporate/contact.htm

No mailer-daemon received on 'security@axis.com' post.

Have a nice day
/bashis