Shoutcast service signature.

Hi,

nessus told me:

    An unknown server is running on this port.
    If you know what it is, please send this banner to the Nessus team:
    00: 49 43 59 20 34 30 31 20 53 65 72 76 69 63 65 20    ICY 401 Service
    10: 55 6e 61 76 61 69 6c 61 62 6c 65 0d 0a 69 63 79    Unavailable..icy
    20: 2d 6e 6f 74 69 63 65 31 3a 3c 42 52 3e 53 48 4f    -notice1:<BR>SHO
    30: 55 54 63 61 73 74 20 44 69 73 74 72 69 62 75 74    UTcast Distribut
    40: 65 64 20 4e 65 74 77 6f 72 6b 20 41 75 64 69 6f    ed Network Audio
    50: 20 53 65 72 76 65 72 2f 4c 69 6e 75 78 20 76 31     Server/Linux v1
    60: 2e 39 2e 32 3c 42 52 3e 0d 0a 69 63 79 2d 6e 6f    .9.2<BR>..icy-no
    70: 74 69 63 65 32 3a 54 68 65 20 72 65 73 6f 75 72    tice2:The resour
    80: 63 65 20 72 65 71 75 65 73 74 65 64 20 69 73 20    ce requested is
    90: 63 75 72 72 65 6e 74 6c 79 20 75 6e 61 76 61 69    currently unavai
    a0: 6c 61 62 6c 65 3c 42 52 3e 0d 0a 0d 0a             lable<BR>....


This is shoutcast 1.9.2. The default tcp port is 8000.
This banner says 401 service unavailable because nessus did not ask for
a valid stream.
A valid request for http://64.236.45.141/stream/1005 would look like:

GET /stream/1005 HTTP/1.0
Host: 64.236.34.141
User-Agent: xmms/1.2.7
Icy-MetaData:1
x-audiocast-udpport: 33364

A response might look like:
ICY 200 OK
icy-notice1: <BR>This stream requires <a href="http://www.winamp.com/">Winamp</a><br>
icy-notive2: SHOUTcast Distributed Network Audio Server/SolarisSparc v1.9.2<BR>
icy-name: SmoothJazz.com - The world's best Smooth Jazz - live from Monterey, Calif
icy-genre: Smooth Jazz
icy-url: http://www.smoothjazz.com/main.htm
icy-pub:1
icy-metaint: 32768
icy-br: 128
icy-irc: #shoutcast
icy-icq: 0
icy-aim: N/A


This data is real from smoothjazz.com radio as seen in tcpdump logs :)

There were several vulnerabilities in shoutcast 1.8.x.
As such:
http://www.secunia.com/advisories/8243/

Regards,
Maciej