Technical Description / Proof of Concept Code 8.1. The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.Ĩ.
and were discovered and researched by Francisco Falcon and Nahuel Riva from Core Exploit Writers Team. The PoC of was made by Martin Rocha with help of Juan Cotta from Core QA Team.
#Vivotech ip camera pro#
and were discovered and researched by Martin Rocha from Core Impact Pro Team. was originally discovered and reported by Alejandro Leon Morales and re-discovered on new firmware versions by Flavio De Cristofaro from Core Security. Filter strings in the parameter system.ntp on every request made to the binary farseer.out.Have at least one proxy filtering /././ and getparam.cgi in HTTP requests.Filter RTSP traffic (default port 554) if possible.Do not expose the camera to internet unless absolutely necessary.
There was no official answer from Vivotek after several attempts to report these vulnerabilities (see ). Vendor Information, Solutions and Workarounds Other Vivotek cameras/firmware are probably affected too, but they were not checked.Vivotek PT7135 IP camera with firmware 0400a.Vivotek PT7135 IP camera with firmware 0300a.to execute arbitrary commands from the administration web interface (pre-authentication with firmware 0300a and post-authentication with firmware 0400a).to dump the camera's memory and retrieve user credentials,.to process GET requests that contain sensitive information,.Multiple vulnerabilities have been found in Vivotek IP cameras (and potentially cameras from other vendors sharing the affected firmware) that could allow an unauthenticated remote attacker: Vulnerability InformationĬlass: Information leak through GET request, Buffer overflow, Authentication issues, Path traversal, OS command injection ĬVE Name: CVE-2013-1594, CVE-2013-1595, CVE-2013-1596, CVE-2013-1597, CVE-2013-1598 Title: Vivotek IP Cameras Multiple Vulnerabilities
0 kommentar(er)
