Geovision Digital Video Surveillance System Directory Traversal Vulnerability

Bugtraq ID:	33735
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 11 2009 12:00AM
Updated:	Feb 12 2009 05:48PM
Credit:	Dejan Levaja
Vulnerable:	GeoVision Digital Surveillance System 8.2
Not Vulnerable:	GeoVision Digital Surveillance System 8.3

Geovision Digital Video Surveillance System Directory Traversal Vulnerability

Geovision Digital Video Surveillance System is prone to a directory-traversal vulnerability.

Exploiting this issue allows an attacker to write arbitrary files to locations outside the application's current directory or to obtain sensitive information. Other attacks are also possible.

Geovision Digital Video Surveillance System Directory Traversal Vulnerability

The following example URI is available:

http://www.example.com/../../../../../../windows/system32/whatever.something

Geovision Digital Video Surveillance System Directory Traversal Vulnerability

Solution:
Reports indicate that the vendor fixed this issue in version 8.3. Please see the references for more information.

Geovision Digital Video Surveillance System Directory Traversal Vulnerability

References:

• Vendor Homepage (GeoVision)
  
• Directory traversal vulnerability in Geovision Digital Video ([email protected])