Stack-based buffer overflow in the HTTP::getAuthUserPass function (core/common/http.cpp) in Peercast 0.1218 and gnome-peercast allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Basic Authentication string with a long (1) username or (2) password.

Nico Golde discovered that PeerCast, a P2P audio and video streaming server, is vulnerable to a buffer overflow in the HTTP Basic Authentication code, allowing a remote attacker to crash PeerCast or execure arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200807-11 (PeerCast: Buffer overflow)

    Nico Golde reported a boundary error in the HTTP::getAuthUserPass()     function when processing overly long HTTP Basic authentication     requests.
  Impact :

    A remote attacker could send a specially crafted HTTP request to the     vulnerable server, possibly resulting in the remote execution of     arbitrary code with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in GNOME PeerCast, the GNOME interface to PeerCast, a P2P audio and video streaming server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6454     Luigi Auriemma discovered that PeerCast is vulnerable to     a heap overflow in the HTTP server code, which allows     remote attackers to cause a denial of service and     possibly execute arbitrary code via a long SOURCE     request.

  - CVE-2008-2040     Nico Golde discovered that PeerCast, a P2P audio and     video streaming server, is vulnerable to a buffer     overflow in the HTTP Basic Authentication code, allowing     a remote attacker to crash PeerCast or execute arbitrary     code.

Nico Golde discovered that PeerCast, a P2P audio and video streaming server, is vulnerable to a buffer overflow in the HTTP Basic Authentication code, allowing a remote attacker to crash PeerCast or execute arbitrary code.

ID	Name	Product	Family	Severity
56490	FreeBSD : peercast -- arbitrary code execution (402ae710-26a2-11dd-ae05-825f4c35000a)	Nessus	FreeBSD Local Security Checks	high
33557	GLSA-200807-11 : PeerCast: Buffer overflow	Nessus	Gentoo Local Security Checks	high
32405	Debian DSA-1583-1 : gnome-peercast - buffer overflow	Nessus	Debian Local Security Checks	critical
32404	Debian DSA-1582-1 : peercast - buffer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2008-2040

critical

Tenable Plugins

high

high

critical

high