|
Active Webcam Denial of Service and Local File Detection
|
|
Secunia Advisory:
|
SA14553
|
|
|
Release Date:
|
2005-03-10
|
|
Last Update:
|
2005-03-14
|
|
Popularity:
|
6,328 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Exposure of system information
DoS
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| Software: | Active Webcam 5.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-0730
CVE-2005-0731
CVE-2005-0732
CVE-2005-0733
CVE-2005-0734
|
|
Description:
Sowhat has reported two vulnerabilities and a weakness in Active Webcam, which can be exploited by malicious people to cause a DoS (Denial of Service) and detect the presence of local files.
1) An input validation error can be exploited to cause a vulnerable server to become unaccessible by requesting a specially crafted file.
Example:
http://[victim]:8080/A:\a.txt
The vulnerability has been confirmed in version 5.5. Other versions may also be affected.
2) Different error messages are returned to users depending on whether a given file exists or not. This can be exploited to detect the presence of local files.
Example:
http://[victim]:8080/c:\test.txt
It is also possible to disclose the full installation path by requesting a non-existing file.
The weakness has been confirmed in version 5.5. Other versions may also be affected.
3) An error in the HTTP communication handling can be exploited to crash a vulnerable service by sending a large amount of HTTP requests (more than 1000).
The vulnerability has been reported in version 5.5. Other versions may also be affected.
Solution:
Filter traffic to the HTTP server or use another product.
Provided and/or discovered by:
Sowhat
Changelog:
2005-03-14: Added CVE reference.
Original Advisory:
http://secway.org/advisory/ad20050104.txt
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
