critical9.4Public exploit code
CVE-2008-5674
Multiple array index errors in the HTTP server in Darkwet Network webcamXP 3.72.440.0 and earlier and beta 4.05.280 and earlier allow remote attackers to cause…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WebcamXP 3.72.440/4.05.280 Beta - '/show_gallery_pic?id' Arbitrary Memory Disclosure2008-02-18 · webapps · multiple · Verified
- WebcamXP 3.72.440/4.05.280 Beta - '/pocketpc?camnum' Arbitrary Memory Disclosure2008-02-18 · webapps · multiple · Verified
Impact
Multiple array index errors in the HTTP server in Darkwet Network webcamXP 3.72.440.0 and earlier and beta 4.05.280 and earlier allow remote attackers to cause a denial of service (device crash) and read portions of memory via (1) an invalid camnum parameter to the pocketpc component and (2) an invalid id parameter to the show_gallery_pic component.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Darkwet | Webcam Xp | through 3.72.440.0 Versions 1.02.432, 1.02.535, 1.6.945, 2.20, 3.72 |
Weakness classification
References
- NVD record
- CVE.org record
- http://aluigi.altervista.org/adv/webcamxp-adv.txt
- http://osvdb.org/42929
- http://secunia.com/advisories/29007
- http://securityreason.com/securityalert/4788
- http://www.osvdb.org/42927
- http://www.osvdb.org/42928
- http://www.securityfocus.com/archive/1/488364/100/200/threaded
- http://www.securityfocus.com/bid/27875
- http://aluigi.altervista.org/adv/webcamxp-adv.txt
- http://osvdb.org/42929
- http://secunia.com/advisories/29007
- http://securityreason.com/securityalert/4788
- http://www.osvdb.org/42927
- http://www.osvdb.org/42928
- http://www.securityfocus.com/archive/1/488364/100/200/threaded
- http://www.securityfocus.com/bid/27875