Icecast Server Slash File Name Denial Of Service Vulnerability
BID:2933
Info
Icecast Server Slash File Name Denial Of Service Vulnerability
| Bugtraq ID: | 2933 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 26 2001 12:00AM |
| Updated: | Jun 26 2001 12:00AM |
| Credit: | This vulnerability was submitted to BugTraq on June 26th, 2001 by gollum <[email protected]> from Digit-Labs. |
| Vulnerable: |
Icecast Icecast 1.3.10 -1 Icecast Icecast 1.3.9 -2 Icecast Icecast 1.3.9 -1 Icecast Icecast 1.3.9 Icecast Icecast 1.3.8 beta2 Icecast Icecast 1.3.8 Icecast Icecast 1.3.7 -1 Icecast Icecast 1.3.7 Icecast Icecast 1.3.5 -1 Icecast Icecast 1.3.5 Icecast Icecast 1.3 .10 Icecast Icecast 1.3 .0 Icecast Icecast 1.1.4 Icecast Icecast 1.1.3 Icecast Icecast 1.1.2 Icecast Icecast 1.1.1 Icecast Icecast 1.1 .0 Icecast Icecast 1.0 .0 |
| Not Vulnerable: |
Icecast Icecast 1.3.11 |
Discussion
Icecast Server Slash File Name Denial Of Service Vulnerability
Icecast is an open source audio-streaming server for both Unix and Microsoft Windows systems.
Icecast does not sufficiently sanitize user-supplied input, or sanely handle unexpected input. Upon receiving a request from a user for a file that ends with a slash or period, the server will crash. The behaviour occurs when the remote attacker adds an '/', '\' or '.' to the end the URL they craft to request the file. The request of an existing file is not necessary, as the Icecast server will fail regardless.
Icecast is an open source audio-streaming server for both Unix and Microsoft Windows systems.
Icecast does not sufficiently sanitize user-supplied input, or sanely handle unexpected input. Upon receiving a request from a user for a file that ends with a slash or period, the server will crash. The behaviour occurs when the remote attacker adds an '/', '\' or '.' to the end the URL they craft to request the file. The request of an existing file is not necessary, as the Icecast server will fail regardless.
References
Icecast Server Slash File Name Denial Of Service Vulnerability
References:
References:
- Icecast Homepage (Icecast)