Active WebCam Webserver <= 5.5 Multiple Vulnerabilities (DoS, Path Disc)

medium Nessus Plugin ID 17320

Language:

Synopsis

The remote web server is affected by multiple vulnerabilities.

Description

The version of PY Software's Active WebCam web server running on the remote host is affected by multiple vulnerabilities:

o Denial of Service Vulnerabilities.
A request for a file on floppy drive may result in a dialog prompt, causing the service to cease until it is acknowledged by an administrator. In addition, requesting the file 'Filelist.html' reportedly causes CPU usage on the remote host to increase, ultimately leading to denial of service.

o Information Disclosure Vulnerabilities.
A request for a nonexistent file will return an error message with the installation path for the software. Further, error messages differ depending on whether a file exists or is inaccessible. An attacker may exploit these issues to gain information about the filesystem on the remote host.

Note that while versions 4.3 and 5.5 are known to be affected, earlier versions are likely to be as well.

Solution

Unknown at this time.

Plugin Details

Severity: Medium

ID: 17320

File Name: activewebcam_multiple_vulns.nasl

Version: 1.28

Type: remote

Family: CGI abuses

Published: 3/12/2005

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 3/10/2005

Reference Information

CVE: CVE-2005-0730, CVE-2005-0731, CVE-2005-0732, CVE-2005-0733, CVE-2005-0734

BID: 12778

Detections

Analytics