PT-2008-6726 · Moonware Studios · Webcamxp

Luigi Auriemma · Published 2008-12-18 · Updated 2018-10-11 · CVE-2008-5674

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions webcamXP versions 3.72.440.0 and earlier webcamXP beta versions 4.05.280 and earlier

Description The issue concerns multiple array index errors in the HTTP server of the affected software. These errors can be exploited by remote attackers to cause a denial of service, resulting in a device crash, and to read portions of memory. The exploitation can occur through two specific components: (1) the pocketpc component, which is vulnerable to an invalid camnum parameter, and (2) the show gallery pic component, which is vulnerable to an invalid id parameter.

Recommendations For webcamXP versions 3.72.440.0 and earlier, consider restricting access to the pocketpc and show gallery pic components until a fix is available. For webcamXP beta versions 4.05.280 and earlier, avoid using the camnum parameter in the pocketpc component and the id parameter in the show gallery pic component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-5674

Affected Products

Webcamxp

References · 11

• 🔥 http://securityfocus.com/bid/27875 · Exploit
• 🔥 https://exploit-db.com/exploits/31233 · Exploit
• 🔥 https://exploit-db.com/exploits/31234 · Exploit
• http://secunia.com/advisories/29007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5674 · Security Note
• http://securityreason.com/securityalert/4788 · Note
• http://osvdb.org/42928 · Note
• http://securityfocus.com/archive/1/488364/100/200/threaded · Note
• http://osvdb.org/42927 · Note
• http://aluigi.altervista.org/adv/webcamxp-adv.txt · Note
• http://osvdb.org/42929 · Note