[NT] Willings WebCam Plain Text Password
From: SecuriTeam (support_at_securiteam.com)
Date: 05/17/05
- Previous message: SecuriTeam: "[TOOL] .NETMon - .NET Flow Tracing"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 17 May 2005 11:09:50 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Willings WebCam Plain Text Password
------------------------------------------------------------------------
SUMMARY
" <http://www.willingsoftware.com/> Willing Webcam is a simple, yet
fully-featured software tool designed to help you capture streaming video
and snapshots and publish them on your website. "
Willings WebCam stores administrator's password in plain text in the
memory, allowing local attackers to retrieve it.
DETAILS
Vulnerable Systems:
* Willings WebCam version 2.8 and prior
The problem resides in the fact that the application will execute a
function that loads the password into static memory before the user has
even identified himself. A simple read operation at this address will
reveal the password.
Memory: Willings WebCam ( ww.exe )
AllocationBase: 7B930000 - Read/Write - Private
-----------------------------------------------------------------------\
00 00 00 44 45 47 65 74 42 6C 6F 63 6B 46 6D 74 ; ...DEGetBlockFmt |
4E 61 6D 65 73 50 61 72 61 6D 00 00 00 00 00 40 ; NamesParam.....@ |
00 00 00 00 00 00 00 31 00 00 00 44 45 47 65 74 ; .......1...DEGet |
42 6C 6F 63 6B 46 6D 74 4E 61 6D 65 73 50 61 72 ; BlockFmtNamesPar |
61 6D 2E 44 45 47 65 74 42 6C 6F 63 6B 46 6D 74 ; am.DEGetBlockFmt |
4E 61 6D 65 73 50 61 72 61 6D 2E 31 00 00 00 20 ; NamesParam.1... |
00 00 00 01 00 00 00 13 00 00 00 41 63 74 69 6F ; ...........Actio |
6E 4E 65 74 77 6F 72 6B 43 61 6D 65 72 61 00 20 ; nNetworkCamera.
|____________
00 00 00 01 00 00 00 07 00 00 00 53 65 63 75 42 ; ...........SecuB <--/
PLAIN TEXT \
6F 78 00 4E 44 20 50 41 53 53 57 4F 52 44 00 20 ; ox.ND PASSWORD.
<--\____________/
00 00 00 D0 8A 83 00 80 68 9F 7B 01 00 00 00 04 ; ... . h ..... |
00 00 00 65 78 00 00 65 50 61 72 61 6D 2E 44 40 ; ...ex..eParam.D@ |
00 00 00 01 00 00 00 1F 00 00 00 44 69 72 65 63 ; ...........Direc |
74 58 20 76 69 64 65 6F 20 73 6F 75 72 63 65 2E ; tX video source. |
20 20 43 74 72 6C 2B 46 31 30 00 44 65 6E 61 6C ; Ctrl+F10.Denal |
69 44 6C 67 39 38 2E 44 65 6E 61 6C 69 44 6C 00 ; iDlg98.DenaliDl. |
01 00 00 68 35 7B 00 00 6E 93 7B 48 CF 94 7B 01 ; ...h5{..n H . |
-----------------------------------------------------------------------/
Class is "TFormJB" and Window name "Input Password"
Start -> 7b94cf68 - 47 - inc edi
The end, just find -> "ND PASSWORD"
ADDITIONAL INFORMATION
The information has been provided by <mailto:unsecure@writeme.com>
SecuBox fRoGGz.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[TOOL] .NETMon - .NET Flow Tracing"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
