webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.

Three vulnerabilities have been discovered in the mt-daapd DAAP audio server (also known as the Firefly Media Server). The Common Vulnerabilities and Exposures project identifies the following three problems :

  - CVE-2007-5824     Insufficient validation and bounds checking of the     Authorization: HTTP header enables a heap buffer     overflow, potentially enabling the execution of     arbitrary code.

  - CVE-2007-5825     Format string vulnerabilities in debug logging within     the authentication of XML-RPC requests could enable the     execution of arbitrary code.

  - CVE-2008-1771     An integer overflow weakness in the handling of HTTP     POST variables could allow a heap buffer overflow and     potentially arbitrary code execution.

The remote host is affected by the vulnerability described in GLSA-200712-18 (Multi-Threaded DAAP Daemon: Multiple vulnerabilities)

    nnp discovered multiple vulnerabilities in the XML-RPC handler in the     file webserver.c. The ws_addarg() function contains a format string     vulnerability, as it does not properly sanitize username and password     data from the 'Authorization: Basic' HTTP header line (CVE-2007-5825).
    The ws_decodepassword() and ws_getheaders() functions do not correctly     handle empty Authorization header lines, or header lines without a ':'     character, leading to NULL pointer dereferences (CVE-2007-5824).
  Impact :

    A remote attacker could send specially crafted HTTP requests to the web     server in the Multi-Threaded DAAP Daemon, possibly leading to the     execution of arbitrary code with the privileges of the user running the     web server or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

US-CERT reports :

webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.

ID	Name	Product	Family	Severity
33178	Debian DSA-1597-2 : mt-daapd - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
29815	GLSA-200712-18 : Multi-Threaded DAAP Daemon: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
28195	FreeBSD : mt-daapd -- denial of service vulnerability (a7080c30-91a2-11dc-b2eb-00b0d07e6c7e)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2007-5824

high

Tenable Plugins

high

high

high