SHOUTcast Server DNAS Relay Remote Buffer Overflow Vulnerability

Bugtraq ID:	33904
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 25 2009 12:00AM
Updated:	Feb 25 2009 09:07PM
Credit:	Stefan Cornelius
Vulnerable:	NullSoft Shoutcast Server 1.9.8 Win32 NullSoft Shoutcast Server 1.9.7 Win32 NullSoft Shoutcast Server 1.9.5 Win32 NullSoft Shoutcast Server 1.9.4 Win32 NullSoft Shoutcast Server 1.9.2 Win32
Not Vulnerable:

SHOUTcast Server DNAS Relay Remote Buffer Overflow Vulnerability

SHOUTcast Server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may exploit this issue to overwrite the application's web administration password and possibly to execute arbitrary code within the context of the application, but this has not been confirmed. Failed exploit attempts will cause a denial-of-service condition.

SHOUTcast Server 1.9.8 for Windows is vulnerable; other versions may also be affected.

SHOUTcast Server DNAS Relay Remote Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SHOUTcast Server DNAS Relay Remote Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SHOUTcast Server DNAS Relay Remote Buffer Overflow Vulnerability

References:

• Secunia Research: SHOUTcast DNAS Relay Server Buffer Overflow (Secunia Research)
  
• Shoutcast Homepage (Nullsoft)
  
• Secunia Research: SHOUTcast DNAS Relay Server Buffer Overflow (Secunia Research )