Firefly Media Server Multiple Null Pointer Dereference Vulnerabilities

Bugtraq ID:	26309
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2007-5824
Remote:	Yes
Local:	No
Published:	Nov 02 2007 12:00AM
Updated:	Sep 02 2008 02:06PM
Credit:	nnp is credited with the discovery of these vulnerabilities.
Vulnerable:	Gentoo Linux Firefly Media Server 0.2.4 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

Firefly Media Server Multiple Null Pointer Dereference Vulnerabilities

Firefly Media Server is prone to multiple NULL-pointer-dereference vulnerabilities.

An attacker can exploit these issues to crash the affected application, denying service to legitimate users. Given the nature of these issues, remote attackers may also be able to execute code, but this has not been confirmed.

Firefly Media Server 0.2.4 is vulnerable; other versions may also be affected.

Firefly Media Server Multiple Null Pointer Dereference Vulnerabilities

The following exploits are available:

• /data/vulnerabilities/exploits/uph0701.py
• /data/vulnerabilities/exploits/uph0702.py

Firefly Media Server Multiple Null Pointer Dereference Vulnerabilities

Solution:
Vendor advisories are available. Please see the references for more information.

Firefly Media Server Multiple Null Pointer Dereference Vulnerabilities

References:

• Firefly Media Server Homepage (Firefly)
  
• [UPH-07-01] Firefly Media Server DoS (nnp )
  
• [UPH-07-02] Firefly Media Server DoS (nnp )