Debian: several problems in icecast-server
 by Patrick Lenz, in Security - Wed, Dec 5th 2001 07:07 UTC

The icecast-server (a streaming music server) package as distributed in Debian GNU/Linux 2.2 has several security problems, including: if a client added a / after the filename of a file to be downloaded the server would crash, by escaping dots as %2E it was possible to circumvent security measures and download arbitrary files, and there were several buffer overflows that could be exploited to gain root access. Fixed packages are available from security.debian.org.

Links: security.debian.org

-----BEGIN PGP SIGNED MESSAGE-----

- ------------------------------------------------------------------------
Debian Security Advisory DSA-089-1                   security@debian.org
http://www.debian.org/security/                         Wichert Akkerman
December  5, 2001
- ------------------------------------------------------------------------


Package        : icecast-server
Problem type   : remote root exploit (and others)
Debian-specific: no

The icecast-server (a streaming music server) package as distributed
in Debian GNU/Linux 2.2 has several security problems:

* if a client added a / after the filename of a file to be downloaded
  the server would crash
* by escaping dots as %2E it was possible to circumvent security measures
  and download arbitrary files
* there were several buffer overflows that could be exploited to
  gain root access

These have been fixed in version 1.3.10-1, and we strongly recommend
that you upgrade your icecast-server package immediately.

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Potato was released for alpha, arm, i386, m68k, powerpc and sparc.


  Source archives:
    http://security.debian.org/dists/stable/updates/main/source/icecast-server_1.3.10-1.dsc
      MD5 checksum: 1bc6e9ad32ac36ee3aa696433e01238e
    http://security.debian.org/dists/stable/updates/main/source/icecast-server_1.3.10-1.tar.gz
      MD5 checksum: 7274a8795e854789f42713b9ce6adfff

  Alpha architecture:
    http://security.debian.org/dists/stable/updates/main/binary-alpha/icecast-server_1.3.10-1_alpha.deb
      MD5 checksum: b35a6b302ee9a6acbd924f2fe3683880

  ARM architecture:
    http://security.debian.org/dists/stable/updates/main/binary-arm/icecast-server_1.3.10-1_arm.deb
      MD5 checksum: 10da80b8b3aa0b0d94203f1b42a257b8

  Intel IA-32 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-i386/icecast-server_1.3.10-1_i386.deb
      MD5 checksum: eb3869696168f5fad229166490061d4b

  Motorola 680x0 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-m68k/icecast-server_1.3.10-1_m68k.deb
      MD5 checksum: 879e091a75a3d68fbaabfff30651ff9a

  PowerPC architecture:
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/icecast-server_1.3.10-1_powerpc.deb
      MD5 checksum: 20d406a0dba293b046cbd65405894849

  Sun Sparc architecture:
    http://security.debian.org/dists/stable/updates/main/binary-sparc/icecast-server_1.3.10-1_sparc.deb
      MD5 checksum: e4e7e37ccbb6993c67bd936cfa7b848b


  These packages will be moved into the stable distribution on its next
  revision.

For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .

- -- 
- ----------------------------------------------------------------------------
apt-get: deb http://security.debian.org/ stable/updates main
dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQB1AwUBPA4FxqjZR/ntlUftAQEiKwL/ZElTSV9pFKLTBpp7mTgTwZr1rJBRlsd5
ftLHOhFCFgBGPKlgT/s02X2ywFdxapURodHCcoukAV0yNjUZnBACCtEJ/N/XsVtG
/AaiY4d3G1NiuoVSa9sbzzkKTQTUUMxY
=Benj
-----END PGP SIGNATURE-----

[Comments are disabled]

Referenced projects icecast - A streaming media broadcasting system.