Icecast Server Base64 Authorization Request Remote Buffer Overflow Vulnerability

Bugtraq ID:	10311
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	May 10 2004 12:00AM
Updated:	May 10 2004 12:00AM
Credit:	Discovery is credited to ned <[email protected]>.
Vulnerable:	Icecast Icecast 2.0
Not Vulnerable:	Icecast Icecast 2.1 .0

Icecast Server Base64 Authorization Request Remote Buffer Overflow Vulnerability

It has been reported that Icecast server may be prone to a remote buffer overflow vulnerability when processing an excessively long base64 authentication request. A remote attacker could execute arbitrary code in the context of the server leading to unauthorized access.

This issue is reported to exist in Icecast 2.0.0, however, it is possible that previous versions are affected as well.

Icecast Server Base64 Authorization Request Remote Buffer Overflow Vulnerability

The researchers responsible for discovering this vulnerability have created proof of concept code to exploit this issue. The proof of concept is not available at the moment.

Icecast Server Base64 Authorization Request Remote Buffer Overflow Vulnerability

Solution:
A Gentoo advisory has been released to provide upgrades. Upgrades may be applied with the following commands (run as root):

emerge sync
emerge -pv ">=net-misc/icecast-2.0.1"
emerge ">=net-misc/icecast-2.0.1"

Icecast 2.1.0 addresses this issue.


Icecast Icecast 2.0

• Icecast Icecast 2.1.0
  http://www.icecast.org/download.php

Icecast Server Base64 Authorization Request Remote Buffer Overflow Vulnerability

References:

• Icecast Homepage (Icecast)