Format string vulnerability in the ws_addarg function in webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to execute arbitrary code via a stats method action to /xml-rpc with format string specifiers in the (1) username or (2) password portion of base64-encoded data on the "Authorization: Basic" HTTP header line.

Three vulnerabilities have been discovered in the mt-daapd DAAP audio server (also known as the Firefly Media Server). The Common Vulnerabilities and Exposures project identifies the following three problems :

  - CVE-2007-5824     Insufficient validation and bounds checking of the     Authorization: HTTP header enables a heap buffer     overflow, potentially enabling the execution of     arbitrary code.

  - CVE-2007-5825     Format string vulnerabilities in debug logging within     the authentication of XML-RPC requests could enable the     execution of arbitrary code.

  - CVE-2008-1771     An integer overflow weakness in the handling of HTTP     POST variables could allow a heap buffer overflow and     potentially arbitrary code execution.

The remote host is affected by the vulnerability described in GLSA-200712-18 (Multi-Threaded DAAP Daemon: Multiple vulnerabilities)

    nnp discovered multiple vulnerabilities in the XML-RPC handler in the     file webserver.c. The ws_addarg() function contains a format string     vulnerability, as it does not properly sanitize username and password     data from the 'Authorization: Basic' HTTP header line (CVE-2007-5825).
    The ws_decodepassword() and ws_getheaders() functions do not correctly     handle empty Authorization header lines, or header lines without a ':'     character, leading to NULL pointer dereferences (CVE-2007-5824).
  Impact :

    A remote attacker could send specially crafted HTTP requests to the web     server in the Multi-Threaded DAAP Daemon, possibly leading to the     execution of arbitrary code with the privileges of the user running the     web server or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote host is running Firefly Media Server, also known as mt-daapd, a media streaming server. 

The version of Firefly Media Server installed on the remote host apparently fails to sanitize user-supplied input before using it as the format string in a call to 'vsnprintf'' in 'src/webserver.c'. Using a specially crafted HTTP Authorization request header, an unauthenticated, remote attacker can leverage this issue to crash the affected service or to execute arbitrary code on the affected system, subject to the privileges under which the service operates.

ID	Name	Product	Family	Severity
33178	Debian DSA-1597-2 : mt-daapd - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
29815	GLSA-200712-18 : Multi-Threaded DAAP Daemon: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
27619	Firefly Media Server webserver.c ws_addarg Function /xml-rpc Authorization Header Remote Format String	Nessus	Gain a shell remotely	high

Detections

Analytics

CVE-2007-5825

critical

Tenable Plugins

high

high

high