GeoVision Digital Surveillance System Unauthorized JPEG Image Access Vulnerability

Bugtraq ID:	13571
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 10 2005 12:00AM
Updated:	May 10 2005 12:00AM
Credit:	Discovery is credited to Tirath Rai <[email protected]>.
Vulnerable:	GeoVision Digital Surveillance System 6.1 GeoVision Digital Surveillance System 6.0 4
Not Vulnerable:

GeoVision Digital Surveillance System Unauthorized JPEG Image Access Vulnerability

GeoVision Digital Surveillance System is prone to a vulnerability that allows remote unauthorized attackers to view JPEG images stored on a server.

This issue results from an access validation error.

GeoVision Digital Surveillance System versions 6.04 or 6.1 are reportedly vulnerable.

GeoVision Digital Surveillance System Unauthorized JPEG Image Access Vulnerability

An exploit is not required.

The following proof of concept examples are available:
http://www.example.com/cam1.jpg
http://www.example.com/cam2.jpg
http://www.example.com/cam[1-16].jpg

GeoVision Digital Surveillance System Unauthorized JPEG Image Access Vulnerability

Solution:
It is reported that this issue does not arise in GeoVision Digital Video Surveillance System version 7.0 configured with the 'Enhanced Network Security' feature.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

GeoVision Digital Surveillance System Unauthorized JPEG Image Access Vulnerability

References:

• Vendor Homepage (GeoVision)