Linksys Web Camera Software Next_file Parameter File Disclosure Vulnerability

Bugtraq ID:	10476
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 07 2004 12:00AM
Updated:	Jun 07 2004 12:00AM
Credit:	Discovery is credited to John Doe <[email protected]>.
Vulnerable:	Linksys Web Camera Software 2.10
Not Vulnerable:

Linksys Web Camera Software Next_file Parameter File Disclosure Vulnerability

It is reported that Linksys Web Camera software is prone to a remote file disclosure vulnerability that may allow a remote attacker to disclose sensitive files.

Linksys Web Camera software version 2.10 is reportedly prone to this issue, however, it is possible that other versions are affected as well.

Linksys Web Camera Software Next_file Parameter File Disclosure Vulnerability

No exploit is required.

The following proof of concept is available:
http://www.example.com/main.cgi?next_file=/etc/passwd

Linksys Web Camera Software Next_file Parameter File Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Linksys Web Camera Software Next_file Parameter File Disclosure Vulnerability

References:

• Linksys Homepage (Linksys)
  
• Linksys Web Camera File Inclusion Vuln (John Doe )