| View previous topic :: View next topic |
| Author |
Message |
rusuweb
Joined: 21 Oct 2008
Posts: 2
|
 Posted: Tue Oct 21, 2008 11:48 am Post subject: Icecast Buffer Overflow |
 |
|
Hi
We run a Radio station as a not for profit and have been told that we cannot allow external access till this problem is resolved.
Network Department wont release port :8000 due to a scan report coming back which says this.
#########################
Port irdmi (8000/tcp)
Service detection
A web server is running on this port.
Nessus ID : http://www.nessus.org/plugins/index.php?view=single&id=22964
OpenLink web config buffer overflow
It is possible to make the remote server execute
arbitrary code by sending one of these two URLs :
GET AAA[....]AAA
GET /cgi-bin/testcono?AAAAA[...]AAA HTTP/1.0
Solution : Upgrade.
Risk factor : High
CVE : CVE-1999-0943
Nessus ID : http://www.nessus.org/plugins/index.php?view=single&id=10169
#########################
This is a problem and is it possible to disable the web access for icecast? (Windows 2003 Server - Running latest icecast)
Is their a patch for this or any beta release to sort this? |
|
| Back to top |
|
 |
karlH
Code Warrior
Joined: 13 Jun 2005
Posts: 5476
Location: UK
|
| Posted: Tue Oct 21, 2008 3:31 pm Post subject: |
|
|
What exactly is the problem, you can disable fileserving access by setting fileserve to 0 but is there an actual problem
karl. |
|
| Back to top |
|
|
rusuweb
Joined: 21 Oct 2008
Posts: 2
|
| Posted: Tue Oct 21, 2008 3:33 pm Post subject: |
|
|
Hi Karl
The problem appears to be the web server thats runs the web admin part, would turning fileserve to 0 stop this? |
|
| Back to top |
|
|
karlH
Code Warrior
Joined: 13 Jun 2005
Posts: 5476
Location: UK
|
| Posted: Fri Oct 24, 2008 2:30 am Post subject: |
|
|
I wouldn't know, the bug reference in question does not relate to icecast and trying a series of URLs that are described does not yield any problems that I can see. As already asked, what exactly is the problem because at the moment it's just an app reporting an error about our app based on something that we are not aware of.
karl. |
|
| Back to top |
|
|
lions
Joined: 03 Nov 2008
Posts: 3
|
| Posted: Mon Nov 03, 2008 4:35 pm Post subject: |
|
|
Hi karlH - can I just confirm that Icecast2 absolutely in no way involves running OpenLink 3.2 (which is what this vulnerability relates to)?
As far as I am aware this looks like a 9 year old exploit so must be a false positive that has nothing to do with Icecast at all (it is actually a linux exploit ??), but obviously this needs confirmation.
Thanks |
|
| Back to top |
|
|
karlH
Code Warrior
Joined: 13 Jun 2005
Posts: 5476
Location: UK
|
| Posted: Mon Nov 03, 2008 6:40 pm Post subject: |
|
|
openlink is a completely separate service to icecast like apache or mysql is, The version of openlink is subject to a buffer overflow and someone is reporting that we are although testing here shows no such problem. I have no idea why it is being flagged as such by these people. The bug report specifically states the openlink application is at fault.
karl. |
|
| Back to top |
|
|
lions
Joined: 03 Nov 2008
Posts: 3
|
| Posted: Mon Nov 03, 2008 7:03 pm Post subject: |
|
|
| karlH wrote: |
openlink is a completely separate service to icecast like apache or mysql is, The version of openlink is subject to a buffer overflow and someone is reporting that we are although testing here shows no such problem. I have no idea why it is being flagged as such by these people. The bug report specifically states the openlink application is at fault.
karl. |
Okay, just confirming. Just I too am trying to show that Icecast is secure enough to be used on a server, and this "issue" was brought up by the owners of the server.
I'm currently doing my own nessus scans but I fully expect to be in agreement with you.
Cheers, karlH.
EDIT: Please could you possibly confirm that this are fixed in 2.3.2
| Quote: |
Synopsis :
The remote media streaming server is affected by multiple issues.
Description :
The remote host is running a version of Icecast that suffers from two
flaws in its XSL parser.
- A Locally-Exploitable Buffer Overflow Vulnerability
The XSL parser does not check the size of XSL 'when', 'if',
and 'value-of' tag values before copying them into a finite
buffer in process memory. An attacker may potentially be
able to exploit this vulnerability to execute arbitrary
code if he can have a specially-crafted XSL file placed in
an Icecast folder.
- An Information Disclosure Vulnerability
The XSL parser fails to parse XSL files when the request ends
with a dot ('.') and instead simply returns the contents.
An attacker can exploit this to uncover sensitive information
contained in XSL files.
See also :
http://www.securityfocus.com/archive/1/393705
http://lists.xiph.org/pipermail/icecast/2005-March/008882.html
Solution :
Unknown at this time.
Risk factor :
Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C /I:N/A:N)
CVE : CVE-2005-0837, CVE-2005-0838
BID : 12849
Other references : OSVDB:14897, OSVDB:14898
Nessus ID : 17592 |
Thank you for your help! |
|
| Back to top |
|
|
karlH
Code Warrior
Joined: 13 Jun 2005
Posts: 5476
Location: UK
|
| Posted: Mon Nov 03, 2008 7:35 pm Post subject: |
|
|
Any security reports are welcome. I don't see any of those issues affecting 2.3.2. For the first one, we use the length returned by the xslt library to determine allocation size, which may of been different in 2.2.0, and I don't see the requested xsl page ending in . bug
karl. |
|
| Back to top |
|
|
lions
Joined: 03 Nov 2008
Posts: 3
|
| Posted: Mon Nov 03, 2008 7:51 pm Post subject: |
|
|
| karlH wrote: |
Any security reports are welcome. I don't see any of those issues affecting 2.3.2. For the first one, we use the length returned by the xslt library to determine allocation size, which may of been different in 2.2.0, and I don't see the requested xsl page ending in . bug
karl. |
Well the changelog did mention an update of libxslt so I'm guessing that fixes that issue. Thanks very much for your help, and I really appreciate the swift responses and time you take to support Icecast!
Also, can Icecast be crashed by having a long GET request string? Or is that a long-old bug? |
|
| Back to top |
|
|
karlH
Code Warrior
Joined: 13 Jun 2005
Posts: 5476
Location: UK
|
| Posted: Mon Nov 03, 2008 9:05 pm Post subject: |
|
|
It's probably an old long bug, although I never saw it originally. There should be no issues with those.
karl. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
