Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
[Full-disclosure] vCAP calendar server Multiple vulnerabilities
Date: Mon Sep 11 2006 - 12:50:22 CDT
title: vCAP calendar server Multiple vulnerabilities
Author: securma massine <securmamorx.org>
MorX Security Research Team
Product info : vCAP (www.pscs.co.uk)is a network calendar server for Windows. vCAP allows user to create calendars which can be viewed and modified by people on network using a web browser.
Original Advisory/PoC : http://www.morx.org/vcap.txt
Severity: Medium/High - user can remotely attack the server
v1: denial of service attack with a specific request
v2: directory traversal , any file on the system can be downloaded ,especially vCAp's passwords (vCAP.db)
Affected Software(s): vCAP calendar server 1.9.0 Beta and prior
Affected platform(s): Windows
Exploit/Proof of Concept:
Solution : ??
16/08/2006 initial vendor contact
17/08/2006 sending vulnerability details
31/08/2006 vulnerability confirmed
this entire document is for eductional, testing and demonstrating purpose only.The author do not have any responsibility for any malicious use of this advisory or proof of concept code.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/