Signature Detail
Short Name |
HTTP:CGI:AXIS-ACCOUNT |
|---|---|
Severity |
Critical |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
axis |
Release Date |
2004/09/30 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Axis Video Server Remote Account Addition
This signature detects a request to an Axis Video Server containing parameters designed to create an Administrator account on the server.
Extended Description
Multiple vulnerabilities are reported to reside in multiple Axis network video and camera servers: 1. A shell metacharacter command-execution vulnerability allows an anonymous user to download the contents of the '/etc/passwd' file on the device. Other commands are also likely to work, facilitating other attacks. This issue is reported to affect: - Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.34 thru 2.40 - Axis 2130 network cameras - Axis 2401 and 2401 video servers 2. A directory-traversal vulnerability in HTTP POST requests. This attack is demonstrated by an anonymous user calling protected administration scripts. This bypasses authentication checks and gives anonymous users remote adminitration of the devices. This issue is reported to affect: - Axis 2100, 2110, 2120, 2420 network cameras with firmware versions 2.12 thru 2.40 - Axis 2130 network cameras - Axis 2401,and 2401 video servers 3. A hardcoded backdoor administrative-user issue allows remote attackers to administer affected devices. This likely cannot be disabled. This issue is reported to affect: - Axis StorePoint CD E100 CD-ROM Server with firmware version 5.30 Other products and versions of firmware are likely affected by one or more of these vulnerabilities.
Affected Products
- Axis Communications 2100 Network Camera 2.12.0
- Axis Communications 2100 Network Camera 2.30.0
- Axis Communications 2100 Network Camera 2.31.0
- Axis Communications 2100 Network Camera 2.32.0
- Axis Communications 2100 Network Camera 2.33.0
- Axis Communications 2100 Network Camera 2.34.0
- Axis Communications 2100 Network Camera 2.40.0
- Axis Communications 2100 Network Camera 2.41.0
- Axis Communications 2110 Network Camera 2.12.0
- Axis Communications 2110 Network Camera 2.30.0
- Axis Communications 2110 Network Camera 2.31.0
- Axis Communications 2110 Network Camera 2.32.0
- Axis Communications 2110 Network Camera 2.34.0
- Axis Communications 2110 Network Camera 2.40.0
- Axis Communications 2110 Network Camera 2.41.0
- Axis Communications 2120 Network Camera 2.12.0
- Axis Communications 2120 Network Camera 2.30.0
- Axis Communications 2120 Network Camera 2.31.0
- Axis Communications 2120 Network Camera 2.32.0
- Axis Communications 2120 Network Camera 2.34.0
- Axis Communications 2120 Network Camera 2.40.0
- Axis Communications 2120 Network Camera 2.41.0
- Axis Communications 2130 PTZ Network Camera 2.30.0
- Axis Communications 2130 PTZ Network Camera 2.31.0
- Axis Communications 2130 PTZ Network Camera 2.32.0
- Axis Communications 2130 PTZ Network Camera 2.34.0
- Axis Communications 2130 PTZ Network Camera 2.40.0
- Axis Communications 230 MPEG-2 Video Server 3.11.0
- Axis Communications 2400+ Blade Video Server 3.12.0
- Axis Communications 2400 Video Server 1.0.0 1
- Axis Communications 2400 Video Server 1.0.0 2
- Axis Communications 2400 Video Server 1.10.0
- Axis Communications 2400 Video Server 1.11.0
- Axis Communications 2400 Video Server 1.12.0
- Axis Communications 2400 Video Server 1.15.0
- Axis Communications 2400 Video Server 2.0.0
- Axis Communications 2400 Video Server 2.20.0
- Axis Communications 2400 Video Server 2.30.0
- Axis Communications 2400 Video Server 2.31.0
- Axis Communications 2400 Video Server 2.32.0
- Axis Communications 2400 Video Server 2.33.0
- Axis Communications 2400 Video Server 2.34.0
- Axis Communications 2400+ Video Server 3.11.0
- Axis Communications 2400+ Video Server 3.12.0
- Axis Communications 2401+ Blade Video Server 3.12.0
- Axis Communications 2401 Video Server 1.0.0 1
- Axis Communications 2401 Video Server 1.15.0
- Axis Communications 2401 Video Server 2.20.0
- Axis Communications 2401 Video Server 2.30.0
- Axis Communications 2401 Video Server 2.31.0
- Axis Communications 2401 Video Server 2.32.0
- Axis Communications 2401 Video Server 2.33.0
- Axis Communications 2401 Video Server 2.34.0
- Axis Communications 2401+ Video Server 3.12.0
- Axis Communications 2401+ Video Server 3.12.0
- Axis Communications 2401+ Video Server 3.13.0
- Axis Communications 2411 Video Server 3.12.0
- Axis Communications 2411 Video Server 3.12.0
- Axis Communications 2411 Video Server 3.13.0
- Axis Communications 2420 Network Camera 2.12.0
- Axis Communications 2420 Network Camera 2.30.0
- Axis Communications 2420 Network Camera 2.31.0
- Axis Communications 2420 Network Camera 2.32.0
- Axis Communications 2420 Network Camera 2.33.0
- Axis Communications 2420 Network Camera 2.34.0
- Axis Communications 2420 Network Camera 2.40.0
- Axis Communications 2420 Network Camera 2.41.0
- Axis Communications 2420 Video Server 2.32.0
- Axis Communications 2420 Video Server 2.34.0
- Axis Communications 2460 Network DVR 3.10.0
- Axis Communications 2460 Network DVR 3.11.0
- Axis Communications 2490 Serial Server 2.11.3
- Axis Communications 250S MPEG-2 Video Server 3.10.0
- Axis Communications 250S Video Server 3.0.0 3
- Axis Communications MPEG-2 Video Server 250S
- Axis Communications Network DVR 2460
- Axis Communications Serial Server 2490
- Axis Communications StorPoint CD
References