[NT] DCAM WebCam Server Directory Traversal Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 12/24/03

  • Next message: SecuriTeam: "[UNIX] XOOPS myheader.php Cross Site Scripting Vulnerability" 
    To: list@securiteam.com
Date: 24 Dec 2003 13:47:20 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      DCAM WebCam Server Directory Traversal Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://sourceforge.net/projects/dcamserver/> DCAM WebCam server is an
    open source program written in VisualBasic that allows to capture live
    streaming video and to broadcast it on the web through the built-in web
    server. A directory traversal vulnerability in the product allows remote
    attackers to download files that reside outside the bound HTML root
    directory.

    DETAILS

    Vulnerable systems:
     * DCAM WebCam server version 8.2.5 and prior

    Immune systems:
     * DCAM WebCam server version 8.2.6

    The web server built into DCAM uses a protection to avoid the directory
    traversal bug. We can see it in Form1.frm:
    ..
    880 page = Replace(page, "..", "")
    881 page = Replace(page, "./", "")
    882 page = Replace(page, "/.", "")
    883 page = Replace(page, "//", "")
    884 page = Replace(page, "\", "")
    ..

    The problem happens when the attacker uses the pattern ".\" that deceives
    the checks and allows him to see and download any file in the remote
    system knowing the path.

    Exploit:
    The following URLs can be used to test your server:
    http://server/.\.\.\.\/windows/system.ini , or
    http://server/.\.\.\.\.\.\.\.\.\.\/windows/system.ini.

    Solution:
    Upgrade to the latest version (version 8.2.6 or newer).

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:aluigi@altervista.org> Luigi
    Auriemma.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] XOOPS myheader.php Cross Site Scripting Vulnerability"

    Relevant Pages