Axis Communications Video Server Command.CGI File Creation Vulnerability

Bugtraq ID:	6987
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 28 2003 12:00AM
Updated:	Feb 28 2003 12:00AM
Credit:	Discovery credited to Martin Eiszner <[email protected]>.
Vulnerable:	Axis Communications 2420 Network Camera 2.33 Axis Communications 2420 Network Camera 2.32 Axis Communications 2420 Network Camera 2.31 Axis Communications 2420 Network Camera 2.12 Axis Communications 2401 Video Server 2.33 Axis Communications 2401 Video Server 2.32 Axis Communications 2401 Video Server 2.31 Axis Communications 2401 Video Server 2.20 Axis Communications 2400 Video Server 2.33 Axis Communications 2400 Video Server 2.32 Axis Communications 2400 Video Server 2.31 Axis Communications 2400 Video Server 2.20 Axis Communications 2130 PTZ Network Camera 2.32
Not Vulnerable:

Axis Communications Video Server Command.CGI File Creation Vulnerability

http://www.example.com/axis-cgi/buffer/command.cgi?buffername=X&prealarm=1&postalarm=1&do=start&uri=/jpg/quad.jpg&format=[bad input]

http://www.example.com/axis-cgi/buffer/command.cgi?whatever paramsbuffername=[relative path to directory]format=[relative path to arbitrary file name]

Axis Communications Video Server Command.CGI File Creation Vulnerability

References:

• Network Camera and Video Servers (Axis Communications)
  
• Axis Video and Camera Servers - System log access and file access/overwrite via (Axis Product Security )
  
• axis2400 webcams (Martin Eiszner )