Directory traversal vulnerability in Icecast 1.3.10 and earlier allows remote attackers to read arbitrary files via a modified .. (dot dot) attack using encoded URL characters.

icecast 1.3.11 and earlier contained numerous security vulnerabilities, the most severe allowing a remote attacker to execute arbitrary code as root.

The remote server runs a version of Icecast, an open source streaming audio server, which is version 1.3.10 or older.

These versions are affected by a directory traversal flaw because the application fails to properly sanitize user-supplied input.

An attacker could send a specially crafted URL to view arbitrary files on the system.

*** Nessus reports this vulnerability using only
*** information that was gathered.

The icecast-server (a streaming music server) package as distributed in Debian GNU/Linux 2.2 has several security problems :

  - if a client added a / after the filename of a file to be     downloaded the server would crash
  - by escaping dots as %2E it was possible to circumvent     security measures and download arbitrary files

  - there were several buffer overflows that could be     exploited to gain root access

These have been fixed in version 1.3.10-1, and we strongly recommend that you upgrade your icecast-server package immediately.


The i386 package mentioned in the DSA-089-1 advisory was incorrectly compiled and will not run on Debian GNU/Linux potato machines. This has been corrected in version 1.3.10-1.1.

The remote host is running a vulnerable version of Icecast, an open-source streaming server. It is reported that every version prior to 1.3.10 is vulnerable to a format string bug that may permit an attacker to overwrite memory at arbitrary address.

The remote host is running a vulnerable version of Icecast, an open-source streaming server. It is reported that every version prior to 1.3.10 is vulnerable to an information disclosure issue. An attacker may craft encoded URL request that may permit him to read files and directory outside the Icecast Server directory.

The remote host is running a vulnerable version of Icecast, an open-source streaming server. It is reported that every version prior to 1.3.10 is vulnerable to a remote denial of service. The problem occurs if an attacker crafts a malicious file request by appending '/', '\' or '.' at the end.

ID	Name	Product	Family	Severity
18950	FreeBSD : icecast 1.x multiple vulnerabilities (5e92e8a2-5d7b-11d8-80e3-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	high
15396	Icecast Encoded Traversal Arbitrary File Access	Nessus	CGI abuses	medium
14926	Debian DSA-089-2 : icecast-server - remote root exploit (and others)	Nessus	Debian Local Security Checks	critical
2144	Icecast < 1.3.10 print_client() Format String	Nessus Network Monitor	Web Servers	medium
2143	Icecast Server < 1.3.10 Directory Traversal Arbitrary File Access	Nessus Network Monitor	Web Servers	medium
2142	Icecast Server < 1.3.10 Crafted URI Remote DoS	Nessus Network Monitor	Web Servers	high

Detections

Analytics

CVE-2001-0784

high

Tenable Plugins

high

medium

critical

medium

medium

high