OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: johninterrorem.com
Date: Thu Jul 26 2001 - 02:23:51 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Interrorem security announcement
    Interrorem - protecting business

    Software vulnerable: Snapstream PVS
    Vendor website: http://www.snapstream.com
    Workaround: Stop the snapstream server

    Software synopsis:
    Snapstream PVS is a Personal Video System for Windows Systems. It allows users to schedule recordings on their PC and to view them later at the leisure, at their local machine or across a TCP/IP network via an HTTP interface.

    Typically, the Snapstream HTTP interface runs on TCP port 8129.

    Problem description:

    Issue 1: Directory traversal bug

    It is possible to navigate outside of the HTTP base directory, and download any file from the host for which the filename is known. The HTTP server runs in the context of the logged in user.

    Examples:

    http://home.victim.com:8080/../../../../autoexec.bat

    http://home.victim.com:8080/../../../winnt/repair/sam

    Risk: High. Any files on the target system are available to an attacker.

    Issue 2: SSD.ini, which contains a great deal of information regarding the target system can be retrieved remotely using the method detailed above.

    Example:

    http://home.victim.com:8080/../ssd.ini

    Risk: High. Information included in the ini file includes base directory location, usernames, and passwords.

    Issue 3: Passwords are stored as plaintext in SSD.INI

    Passwords to the SnapStream PVS software are recoverable remotely using the method detailed in Issue 2.

    Risk: High. Denial of service, destruction of data, exposure of passwords.

    For more information on this, and other security issues, please visit:

    http://www.interrorem.com

    Interrorem - protecting business

    Network Security Specialists
    Security News and Information
    Free Security Software
    OSSTMM.ORG supporters