[NT] Willings WebCam Plain Text Password

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Willings WebCam Plain Text Password
------------------------------------------------------------------------


SUMMARY

" <http://www.willingsoftware.com/> Willing Webcam is a simple, yet 
fully-featured software tool designed to help you capture streaming video 
and snapshots and publish them on your website. "

Willings WebCam stores administrator's password in plain text in the 
memory, allowing local attackers to retrieve it.

DETAILS

Vulnerable Systems:
 * Willings WebCam version 2.8 and prior

The problem resides in the fact that the application will execute a 
function that loads the password into static memory before the user has 
even identified himself. A simple read operation at this address will 
reveal the password.

Memory: Willings WebCam ( ww.exe )
AllocationBase: 7B930000 - Read/Write - Private
-----------------------------------------------------------------------\
00 00 00 44 45 47 65 74 42 6C 6F 63 6B 46 6D 74 ; ...DEGetBlockFmt |
4E 61 6D 65 73 50 61 72 61 6D 00 00 00 00 00 40 ; NamesParam.....@ |
00 00 00 00 00 00 00 31 00 00 00 44 45 47 65 74 ; .......1...DEGet |
42 6C 6F 63 6B 46 6D 74 4E 61 6D 65 73 50 61 72 ; BlockFmtNamesPar |
61 6D 2E 44 45 47 65 74 42 6C 6F 63 6B 46 6D 74 ; am.DEGetBlockFmt |
4E 61 6D 65 73 50 61 72 61 6D 2E 31 00 00 00 20 ; NamesParam.1... |
00 00 00 01 00 00 00 13 00 00 00 41 63 74 69 6F ; ...........Actio |
6E 4E 65 74 77 6F 72 6B 43 61 6D 65 72 61 00 20 ; nNetworkCamera. 
|____________
00 00 00 01 00 00 00 07 00 00 00 53 65 63 75 42 ; ...........SecuB <--/ 
PLAIN TEXT \
6F 78 00 4E 44 20 50 41 53 53 57 4F 52 44 00 20 ; ox.ND PASSWORD. 
<--\____________/
00 00 00 D0 8A 83 00 80 68 9F 7B 01 00 00 00 04 ; ... . h ..... |
00 00 00 65 78 00 00 65 50 61 72 61 6D 2E 44 40 ; ...ex..eParam.D@ |
00 00 00 01 00 00 00 1F 00 00 00 44 69 72 65 63 ; ...........Direc |
74 58 20 76 69 64 65 6F 20 73 6F 75 72 63 65 2E ; tX video source. |
20 20 43 74 72 6C 2B 46 31 30 00 44 65 6E 61 6C ; Ctrl+F10.Denal |
69 44 6C 67 39 38 2E 44 65 6E 61 6C 69 44 6C 00 ; iDlg98.DenaliDl. |
01 00 00 68 35 7B 00 00 6E 93 7B 48 CF 94 7B 01 ; ...h5{..n H . |
-----------------------------------------------------------------------/
Class is "TFormJB" and Window name "Input Password"
Start -> 7b94cf68 - 47 - inc edi
The end, just find -> "ND PASSWORD"


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
SecuBox fRoGGz.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.