Home page logo

bugtraq logo Bugtraq mailing list archives

From: ian.vitek () INFOSEC SE (Vitek, Ian)
Date: Tue, 29 Feb 2000 14:18:54 +0100

Infosec Security Vulnerability Report
No: Infosec.20000229.axisstorpointcd.a

Vulnerability Summary

Problem: Bypassing authentication on Axis StorPoint CD;
               By modifying an URL, outsiders can access
               administrator URLs without entering username
               and password

Threat: Unauthorized access

Platform: Axis StorPoint CD
          Axis StorPoint CD/T
               (Software Version 4.13)

Solution: Upgrade to Software Version 4.28

Vulnerability Description
CDs are available from the URL http://server/cd/
The configuration URL is:
This page is protected by a login and could contain very sensitive information.
The login could be bypassed by the URL:

The server seems to check access permissions before URL conversion.

Infosec and Axis recommends customers to upgrade their StorPoint Software. The
current version is 4.28 and is not vulnerable to this attack.

Additional Information
The Axis StorPoint CD and StorPoint CD/T with Software Version 4.13 are old
products with old software (from 1997). As Axis says:
"Note that the development for StorPoint CD and CD/T has been discontinued from
November 1999, only minor service releases will be available."
Axis has tested their new products, Axis StorPoint CD E100 and StorPoint NAS
100, and this vulnerability was not been found.

Infosec would like to thank Peter Berggren and Johan Diedrichs at Axis for their
involvement with testing and supplying patch information.

//Ian Vitek
ian.vitek () infosec se

Infosec is a Swedish based tigerteam that has worked with computer-related
security since 1982 and done penetration tests and technical revisions since
1996. Infosec is now searching for co-workers. Call Blume on +46-8-6621070 for
more information.

  By Date           By Thread  

Current thread:
  • Infosec.20000229.axisstorpointcd.a Vitek, Ian (Feb 29)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]