[NEWS] PeerCast Format String

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  PeerCast Format String
------------------------------------------------------------------------


SUMMARY

 <http://www.peercast.org/> PeerCast is a popular p2p streaming media 
server (similar to shoutcast) - "PeerCast is a new, free way to listen to 
radio and watch video on the Internet. It uses P2P technology to let 
anyone become a broadcaster without the costs of traditional streaming. 
This means you get to hear and watch stations not normally found on 
commercially funded sites."

PeerCast is vulnerable to format string vulnerability, attackers 
exploiting this vulnerability can cause the server to execute arbitrary 
code.

DETAILS

Vulnerable Systems:
 * Peercast versions 0.1211 and prior

Immune Systems:
 * PeerCast version 0.1212

There is a format string issue in PeerCast that allows an attacker to 
execute arbitrary code on the remote target with the privileges of the 
user running PeerCast or crash the server.

Below is an example of how this vulnerability can be exploited to crash a 
vulnerable server:
http://localhost:7144/html/en/index.htm%n

The problem occurs because of the way some error messages are handled. For 
example in the above example the PeerCast server receives a malformed 
request, so the error routine printed the URL, but the error print routine 
(because it was a printf type function call) then tries to parse the 
malicious URL.

Patch Availability:
An immune version was release shortly after vendor notification and is 
available from:
 <http://www.peercast.org/forum/viewtopic.php?p=11596> 
http://www.peercast.org/forum/viewtopic.php?p=11596


ADDITIONAL INFORMATION

The information has been provided by James Bercegay.
The original article can be found at:  
<http://www.gulftech.org/?node=research&article_id=00077-05282005> 
http://www.gulftech.org/?node=research&article_id=00077-05282005



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.