SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Multimedia)  >   Icecast Vendors:   Icecast.org
(Caldera Issues Fix) Icecast MP3 Streaming Server Buffer Overflow Lets Remote Users Execute Arbitrary Code on the Server, Usually With Root Level Privileges
SecurityTracker Alert ID:  1004286
SecurityTracker URL:  http://securitytracker.com/id/1004286
CVE Reference:   CVE-2002-0177   (Links to External Site)
Date:  May 13 2002
Impact:   Execution of arbitrary code via network, Root access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.3.11 and prior versions
Description:   A vulnerability was reported in the Icecast audio streaming server. A remote user can execute arbitrary code on the server, generally with root level permissions.

A remote user can reportedly trigger a buffer overflow in the Icecast server. This will apparently yield root level access if the Icecast server is run as root, as many users apparently do. Otherwise, this will apparently yield user-level access.

A remote user can create a specially crafted URL to trigger the overflow, which reportedly exists in the client_login() function. According to the report, another buffer overflow may also exist in the icecast extract_vars() function, as well as some libavl routines, but these have not been confirmed.

Demonstration exploit code is provided in the Source Message [it is Base64 encoded].

The vendor has reportedly been notified.

Impact:   A remote user can execute arbitrary code on the server with the privileges of the Icecast server.
Solution:   The vendor has released a fix.

For OpenLinux 3.1.1 Server:

Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

Packages:

83407efa0c40a9ceac02606ae37237f2 icecast-1.3.12-1.i386.rpm

To install:

rpm -Fvh icecast-1.3.12-1.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

Source Packages:

d55ff1702ff28781cf097566e34c91c5 icecast-1.3.12-1.src.rpm


For OpenLinux 3.1 Server:

Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

Packages:

acd0d312bcb7679c205eb5305d7d4585 icecast-1.3.12-1.i386.rpm

To install:

rpm -Fvh icecast-1.3.12-1.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

Source Packages:

b36bf262d34fb88e9a00b695b024916e icecast-1.3.12-1.src.rpm

Vendor URL:  www.icecast.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Caldera/SCO)
Underlying OS Comments:  OpenLinux Server 3.1, 3.1.1

Message History:   This archive entry is a follow-up to the message listed below.
Apr 3 2002 Icecast MP3 Streaming Server Buffer Overflow Lets Remote Users Execute Arbitrary Code on the Server, Usually With Root Level Privileges



 Source Message Contents

Subject:  Security Update: [CSSA-2002-020.0] Linux: icecast buffer overflows and denial-of-service


--sm4nu43k4a2Rpi4c
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		Linux: icecast buffer overflows and denial-of-service
Advisory number: 	CSSA-2002-020.0
Issue date: 		2002 May 10
Cross reference:
______________________________________________________________________________


1. Problem Description

	Buffer overflows in the icecast server allow remote attackers
	to execute arbitrary code via a long HTTP GET request, as well
	as allowing denial of service attacks.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to icecast-1.3.12-1.i386.rpm

	OpenLinux 3.1 Server		prior to icecast-1.3.12-1.i386.rpm


3. Solution

	The proper solution is to install the latest packages.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

	4.2 Packages

	83407efa0c40a9ceac02606ae37237f2	icecast-1.3.12-1.i386.rpm

	4.3 Installation

	rpm -Fvh icecast-1.3.12-1.i386.rpm

	4.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

	4.5 Source Packages

	d55ff1702ff28781cf097566e34c91c5	icecast-1.3.12-1.src.rpm


5. OpenLinux 3.1 Server

	5.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

	5.2 Packages

	acd0d312bcb7679c205eb5305d7d4585	icecast-1.3.12-1.i386.rpm

	5.3 Installation

	rpm -Fvh icecast-1.3.12-1.i386.rpm

	5.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

	5.5 Source Packages

	b36bf262d34fb88e9a00b695b024916e	icecast-1.3.12-1.src.rpm


6. References

	Specific references for this advisory:

		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0784
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1083
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1229
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1230
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0177

	Caldera OpenLinux security resources:
		http://www.caldera.com/support/security/index.html

	Caldera UNIX security resources:
		http://stage.caldera.com/support/security/

	This security fix closes Caldera incidents sr863781, fz520848
	and erg712036.


7. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on this website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera products.


8. Acknowledgements

	The "Packet Knights" group discovered some of these
	vulnerabilities.

______________________________________________________________________________

--sm4nu43k4a2Rpi4c
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjzgL+8ACgkQbluZssSXDTGEzQCfeBKgOxtlmj759FzzoG1LOFEf
2MIAoK8+JwLPVO9oYx18SlROkbfUaSO5
=Afwz
-----END PGP SIGNATURE-----

--sm4nu43k4a2Rpi4c--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC