PT-2008-6726 · Moonware Studios · Webcamxp

Luigi Auriemma · Publicado 2008-12-18 · Atualizado 2018-10-11 · CVE-2008-5674

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions webcamXP versions 3.72.440.0 and earlier webcamXP beta versions 4.05.280 and earlier

Description The issue concerns multiple array index errors in the HTTP server of the affected software. These errors can be exploited by remote attackers to cause a denial of service, resulting in a device crash, and to read portions of memory. The exploitation can occur through two specific components: (1) the pocketpc component, which is vulnerable to an invalid camnum parameter, and (2) the show gallery pic component, which is vulnerable to an invalid id parameter.

Recommendations For webcamXP versions 3.72.440.0 and earlier, consider restricting access to the pocketpc and show gallery pic components until a fix is available. For webcamXP beta versions 4.05.280 and earlier, avoid using the camnum parameter in the pocketpc component and the id parameter in the show gallery pic component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-5674

Produtos afetados

Webcamxp

Referências · 11

• 🔥 http://securityfocus.com/bid/27875 · Exploit
• 🔥 https://exploit-db.com/exploits/31233 · Exploit
• 🔥 https://exploit-db.com/exploits/31234 · Exploit
• http://securityreason.com/securityalert/4788 · Nota
• http://osvdb.org/42928 · Nota
• http://securityfocus.com/archive/1/488364/100/200/threaded · Nota
• http://secunia.com/advisories/29007 · Aviso do Fabricante
• http://osvdb.org/42927 · Nota
• http://aluigi.altervista.org/adv/webcamxp-adv.txt · Nota
• http://osvdb.org/42929 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5674 · Nota de Segurança