Camtron CMNC-200 IP Camera – Directory Traversal

• Exploit Database
• 16 阅读

• 作者： Trustwave's SpiderLabs
  日期： 2010-11-13
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/15505/

• Finding 2: Directory Traversal in Camera Web Server
  CVE: CVE-2010-4231
  
  The CMNC-200 IP Camera has a built-in web server that
  is enabled by default. The server is vulnerable to directory
  transversal attacks, allowing access to any file on the
  camera file system.
  
  The following example will display the contents of
  /etc/passwd:
  
  GET /../../../../../../../../../../../../../etc/passwd
  HTTP/1.1
  
  Because the web server runs as root, an attacker can read
  critical files like /etc/shadow from the web-based
  administration interface. Authentication is not required for
  exploitation.
  
  Vendor Response:
  No response received.
  
  Remediation Steps:
  No patch currently exists for this issue. To limit exposure,
  network access to these devices should be limited to authorized
  personnel through the use of Access Control Lists and proper
  network segmentation.