Firefly Media Server webserver.c ws_addarg Function /xml-rpc Authorization Header Remote Format String

high Nessus Plugin ID 27619


The remote web server is affected by a format string vulnerability.


The remote host is running Firefly Media Server, also known as mt-daapd, a media streaming server.

The version of Firefly Media Server installed on the remote host apparently fails to sanitize user-supplied input before using it as the format string in a call to 'vsnprintf'' in 'src/webserver.c'. Using a specially crafted HTTP Authorization request header, an unauthenticated, remote attacker can leverage this issue to crash the affected service or to execute arbitrary code on the affected system, subject to the privileges under which the service operates.


Either disable the service or upgrade to Firefly Media Server or later.

See Also

Plugin Details

Severity: High

ID: 27619

File Name: firefly_format_string.nasl

Version: 1.21

Type: remote

Published: 11/3/2007

Updated: 11/15/2018

Risk Information


Risk Factor: High

Score: 7.4


Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:firefly:media_server

Exploit Available: true

Exploit Ease: Exploits are available

Exploitable With

Core Impact

Reference Information

CVE: CVE-2007-5825

BID: 26310

CWE: 134