Integer overflow in the ws_getpostvars function in Firefly Media Server (formerly mt-daapd) 0.2.4.1 (0.9~r1696-1.2 on Debian) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a large Content-Length.

Three vulnerabilities have been discovered in the mt-daapd DAAP audio server (also known as the Firefly Media Server). The Common Vulnerabilities and Exposures project identifies the following three problems :

  - CVE-2007-5824     Insufficient validation and bounds checking of the     Authorization: HTTP header enables a heap buffer     overflow, potentially enabling the execution of     arbitrary code.

  - CVE-2007-5825     Format string vulnerabilities in debug logging within     the authentication of XML-RPC requests could enable the     execution of arbitrary code.

  - CVE-2008-1771     An integer overflow weakness in the handling of HTTP     POST variables could allow a heap buffer overflow and     potentially arbitrary code execution.

- Thu May 15 2008 W. Michael Petullo <mike[at]flyn.org> -     0.2.4.2-2

    - Bump epoch.

    - Wed May 14 2008 W. Michael Petullo <mike[at]flyn.org>
      - 0.2.4.2-1

    - New upstream version.

    - Remove check-input patch; it's upstream.

    - Fri Apr 18 2008 W. Michael Petullo <mike[at]flyn.org>
      - 0.9-0.2.1696

    - Apply patch by Nico Golde to fix integer overflow,       Bugzilla #442688.

    - Tue Feb 26 2008 W. Michael Petullo <mike[at]flyn.org>
      - 0.9-0.1.1696

    - New upstream version.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

FrSIRT reports :

A vulnerability has been identified in mt-daapd which could be exploited by remote attackers to cause a denial of service or compromise an affected system. This issue is caused by a buffer overflow error in the ws_getpostvars() function when processing a negative Content-Length : header value, which could be exploited by remote unauthenticated attackers to crash an affected application or execute arbitrary code.

- Bug #442688 - CVE-2008-1771 mt-daapd: integer overflow     allowing remote DoS and possibly arbitrary code     execution

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running Firefly Media Server, also known as mt-daapd, a media streaming server. 

The version of Firefly Media Server installed on the remote host apparently fails to sanitize user-supplied Content-Length field before using it to the call to 'malloc(len+1)' in 'src/webserver.c'. Using a specially crafted HTTP POST content-length request header, an unauthenticated, remote attacker can leverage this issue to crash the affected service or to execute arbitrary code on the affected system, subject to the privileges under which the service operates.

ID	Name	Product	Family	Severity
33178	Debian DSA-1597-2 : mt-daapd - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
32387	Fedora 9 : mt-daapd-0.2.4.2-2.fc9 (2008-4126)	Nessus	Fedora Local Security Checks	high
32146	FreeBSD : mt-daapd -- integer overflow (86a4d810-1884-11dd-a914-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	high
32041	Fedora 8 : mt-daapd-0.9-0.4.1696.fc8 (2008-3250)	Nessus	Fedora Local Security Checks	high
32031	Firefly Media Server ws_getpostvars Function Content-Length Header HTTP Request Handling Overflow	Nessus	Gain a shell remotely	high

Detections

Analytics

CVE-2008-1771

critical

Tenable Plugins

high

high

high

high

high