The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
WebcamXP Access Violation and Limited Informations Disclosure
------------------------------------------------------------------------
SUMMARY
webcamXP is a commercial webcam software with an integrated webserver for
sharing the own videos. An access violation vulnerability and a
information disclosure problem have been found in the WebcamXP product.
DETAILS
Vulnerable Systems:
* webcamXP version 3.72.440.0
* webcamXP version 4.05.280 beta
The pocketpc and show_gallery_pic URI are used by the external users for
watching the images of the current webcams. The problem is that there are
no checks on the webcam's number passed by the client allowing an attacker
to go outside the array which contains all the data about each webcam.
The main effect of this bug is the silent interruption of the service due
to the access violation caused by the reading of unallocated memory and
visible in the browser of the client who has performed the malicious
request. For example /pocketpc allows to access the memory above and below
offset 007196f0 (the location of the array in version 3.72.440.0) with
steps of 6360 bytes for each webcam number.
The secondary effect is the possibility of reading 8 bytes of the
process's memory in an partial arbitrary way (the array's offset is
fixed but is only possible to jump 6360 bytes at time) since /pocketpc
displays these two 32 bit numbers in the "width" and "height" parameters
of the returned HTML page as visible in the assembly code starting from
offset 006BD46F.
Exploits:
http://SERVER:8080/pocketpc?camnum=999999&mode=0
http://SERVER:8080/pocketpc?camnum=-999999&mode=0
http://SERVER:8080/show_gallery_pic?id=999999
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/webcamxp-adv.txt>
http://aluigi.altervista.org/adv/webcamxp-adv.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
