Donato Ferrante
02/05/05, 22:15
Donato Ferrante
Application: Video Cam Server
http://vcs.raybase.com/
Version: 1.0.0
Bugs: Multiple Vulnerabilities
Date: 02-May-2005
Author: Donato Ferrante
e-mail: fdonato@autistici.org
web: www.autistici.org/fdonato
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
1. Description
2. The bugs
3. The code
4. The fix
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
----------------
1. Description:
----------------
Vendor's Description:
"Video Cam Server (VCS) is a server for publishing the image taken from
a Video Camera (especially Web Cam) connected to it. It will be very
useful for remote monitoring your home, office or other environment."
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
-------------
2. The bugs:
-------------
The bugs are located into the built-in webserver.
By default no HTTP Authentication is set so a malicious user can:
i.
(path disclosure) know the remote current path, by sending an
http request for an unavailable page.
ii.
(directory traversal) go out the document root assigned to the
webserver by using common malicious patterns like: ".." into
http requests, and see/download all the files available on the
remote system.
iii.
(denial of service) shutdown http-server and/or camera, by using
admin's control page that it's not properly managed.
NOTE:
Reported vulnerabilities are also valid if the HTTP Authentication is
set, but in this case the malicious user must obtain login information.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
-------------
3. The code:
-------------
To test the vulnerabilities:
i.
http://[host]/%20
ii.
http://[host]/..\..\..\..\..\..\..\..\..\..\..\windows\system.in i
or connect to the webserver and send a raw request like:
GET /../../../../../../../../../../../windows/system.ini HTTP/1.1
iii.
http://[host]/admin.html
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
------------
4. The fix:
------------
Vendor has been notified.
Bugs will be probably fixed in the next release.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
Application: Video Cam Server
http://vcs.raybase.com/
Version: 1.0.0
Bugs: Multiple Vulnerabilities
Date: 02-May-2005
Author: Donato Ferrante
e-mail: fdonato@autistici.org
web: www.autistici.org/fdonato
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
1. Description
2. The bugs
3. The code
4. The fix
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
----------------
1. Description:
----------------
Vendor's Description:
"Video Cam Server (VCS) is a server for publishing the image taken from
a Video Camera (especially Web Cam) connected to it. It will be very
useful for remote monitoring your home, office or other environment."
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
-------------
2. The bugs:
-------------
The bugs are located into the built-in webserver.
By default no HTTP Authentication is set so a malicious user can:
i.
(path disclosure) know the remote current path, by sending an
http request for an unavailable page.
ii.
(directory traversal) go out the document root assigned to the
webserver by using common malicious patterns like: ".." into
http requests, and see/download all the files available on the
remote system.
iii.
(denial of service) shutdown http-server and/or camera, by using
admin's control page that it's not properly managed.
NOTE:
Reported vulnerabilities are also valid if the HTTP Authentication is
set, but in this case the malicious user must obtain login information.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
-------------
3. The code:
-------------
To test the vulnerabilities:
i.
http://[host]/%20
ii.
http://[host]/..\..\..\..\..\..\..\..\..\..\..\windows\system.in i
or connect to the webserver and send a raw request like:
GET /../../../../../../../../../../../windows/system.ini HTTP/1.1
iii.
http://[host]/admin.html
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx
------------
4. The fix:
------------
Vendor has been notified.
Bugs will be probably fixed in the next release.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxx