Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
[Full-disclosure] vCAP calendar server Multiple vulnerabilities

Date: Mon Sep 11 2006 - 12:50:22 CDT

title: vCAP calendar server Multiple vulnerabilities

Author: securma massine <securmamorx.org>
MorX Security Research Team

Product info : vCAP (www.pscs.co.uk)is a network calendar server for Windows. vCAP allows user to create calendars which can be viewed and modified by people on network using a web browser.

Original Advisory/PoC : http://www.morx.org/vcap.txt

Severity: Medium/High - user can remotely attack the server

Vulnerability Description:
v1: denial of service attack with a specific request
v2: directory traversal , any file on the system can be downloaded ,especially vCAp's passwords (vCAP.db)
Affected Software(s): vCAP calendar server 1.9.0 Beta and prior

Affected platform(s): Windows

Exploit/Proof of Concept:

Solution : ??

16/08/2006 initial vendor contact
17/08/2006 sending vulnerability details
31/08/2006 vulnerability confirmed

this entire document is for eductional, testing and demonstrating purpose only.The author do not have any responsibility for any malicious use of this advisory or proof of concept code.

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/