webcamXP Multiple Information Disclosure and Denial of Service Vulnerabilities

Bugtraq ID:	27875
Class:	Input Validation Error
CVE:	CVE-2008-5674
Remote:	Yes
Local:	No
Published:	Feb 19 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	Luigi Auriemma is credited with the discovery of these issues.
Vulnerable:	Darkwet Network WebcamXP 3.72.440 Darkwet Network WebcamXP 4.05.280 beta
Not Vulnerable:

webcamXP Multiple Information Disclosure and Denial of Service Vulnerabilities

webcamXP is prone to multiple information-disclosure and denial-of-service vulnerabilities because it fails to check user-supplied input data.

Attackers can exploit these issues to access potentially sensitive information or crash the application. Successful exploits could aid in further attacks or deny service to legitimate users.

These issues affect webcamXP 3.72.440 and 4.05.280 beta and prior versions.

webcamXP Multiple Information Disclosure and Denial of Service Vulnerabilities

Attackers can exploit these issues via a browser.

The following example URIs are available:

http://www.example.com:8080/pocketpc?camnum=999999&mode=0
http://www.example.com:8080/pocketpc?camnum=-999999&mode=0
http://www.example.com:8080/show_gallery_pic?id=999999

webcamXP Multiple Information Disclosure and Denial of Service Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

webcamXP Multiple Information Disclosure and Denial of Service Vulnerabilities

References:

• webcamXP Homepage (Darkwet Network)
  
• webcamXP: access violation with limited informations disclosure (Luigi Auriemma)
  
• Access violation and limited informations disclosure in webcamXP 3.72.440.0 (Luigi Auriemma )