Security issue in icecast

Jamie Strandboge <[email protected]>
Newsgroups gmane.comp.audio.icecast.devel,gmane.comp.security.oss.general
Message-ID <1323973540.3281.77.camel@localhost>
A security bug was reported by Moritz Naumann against icecast in
Ubuntu. You are being emailed as the upstream contact. Please keep
[email protected][1] CC'd for any updates on this issue.

This issue should be considered public and has not yet been assigned a
CVE.

Details from the public bug follow:
https://launchpad.net/bugs/894782

From the reporter:
"Newline injection in error.log

Running this command against an icecast2 running on 127.0.0.1...

echo -ne "GET /non-existent"'"'"%20No%20such%20file%20or%20directory%0d%
0a[1970-01-01%20%2000:00:00]%20PHUN%20I'm%20feeling%20phunny%0d%
0a["`date "+%Y-%m-%d%%20%%20%H:%M:%S"`"]%20WARN%
20fserve/fserve_client_create%20req%20for%20file%
20"'"'"/usr/share/icecast2/web/ HTTP/1.0\n\n" | nc -vv 127.0.0.1 8000
> /dev/null

...causes the following to be written to /var/log/icecast2/error.log:
[2011-11-25 15:37:31] INFO fserve/fserve_client_create checking for
file /non-existent" No such file or directory
[1970-01-01 00:00:00] PHUN I'm feeling phunny
..."

Thanks in advance for your cooperation in coordinating a fix for this
issue.

[1] [email protected] is a public mailing list for
    people to collaborate on security vulnerabilities and coordinate
    security updates.

-- 
Jamie Strandboge             | http://www.canonical.com

_______________________________________________
Icecast-dev mailing list
[email protected]
http://lists.xiph.org/mailman/listinfo/icecast-dev
signature.asc (application/pgp-signature, 836 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAABCgAGBQJO6jukAAoJEFHb3FjMVZVzg/sP+wc52cVLvz/N55me39hplfdP
rXXM6wZBt4SUP0VzbmBlGHVyU60UWF3UlcTdlo7FK8UpFhcbVBnhy3sfomo/dKhy
fvmH9/bchFwkZNJapjitcC4tvtN7S4nIzBT25raJdHN+iTM/bh/qqolNruYN5305
siYA8l6+ZTZKNRUBJEvHclajGzMUDgYwUNkNV40tgFF2d4DZy+L5GllFBqdT7MTu
Twivq7Qc8uzxcBZVETKclW2mR4+0h9viY9aLQo/a9+t5iCEoeQv6RIvQHh0mOB/h
8W3xoEUP9yrZ3brIfqykBaBUFumR24AeMhoFcdpiGazWeGn+m+H+uBAiLExG/+Hg
bHJKoH0D3lxnMH0/dNBbX3dYy3++7uQH2+IxTmVclxoDFRKix4x5je8/wYKIE59Z
cAQXciaQZIB83Wd2KQIoKVtTl3MCTJWRISRjr/D7XSuG/frWXqx9vaWjbPuAG4CV
0t3ubM+fbJk1lYvdLiY1hGZLFz4YpZYg9k6dDUqycO/35rW5yVAerjdJboZDm61N
5GUG/QpM9TXys1Pu5IxG7tbeiqN/qzZCHavJyPkscimpzXse7QX3SC9TmavLYQmm
W3liwuFxM1vCthLq4ZxLvB4cFZZQlKBd5765eQXtNqp6Wkf7wBNq8LKoq63cN8eJ
srVh3T0008+eWYyFNZJK
=hZoe
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.