Heap-based buffer overflow in the handshakeHTTP function in servhs.cpp in PeerCast 0.1217 and earlier, and SVN 344 and earlier, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long SOURCE request.

Several remote vulnerabilities have been discovered in GNOME PeerCast, the GNOME interface to PeerCast, a P2P audio and video streaming server. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6454     Luigi Auriemma discovered that PeerCast is vulnerable to     a heap overflow in the HTTP server code, which allows     remote attackers to cause a denial of service and     possibly execute arbitrary code via a long SOURCE     request.

  - CVE-2008-2040     Nico Golde discovered that PeerCast, a P2P audio and     video streaming server, is vulnerable to a buffer     overflow in the HTTP Basic Authentication code, allowing     a remote attacker to crash PeerCast or execute arbitrary     code.

The remote host is affected by the vulnerability described in GLSA-200801-22 (PeerCast: Buffer overflow)

    Luigi Auriemma reported a heap-based buffer overflow within the     'handshakeHTTP()' function when processing HTTP requests.
  Impact :

    A remote attacker could send a specially crafted request to the     vulnerable server, possibly resulting in the remote execution of     arbitrary code with the privileges of the user running the PeerCast     server, usually 'nobody'.
  Workaround :

    There is no known workaround at this time.

Luigi Auriemma discovered that PeerCast, a P2P audio and video streaming server, is vulnerable to a heap overflow in the HTTP server code, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long SOURCE request.

Luigi Auriemma reports that peercast is vulnerable to a buffer overflow which could lead to a DoS or potentially remote code execution :

The handshakeHTTP function which handles all the requests received by the other clients is vulnerable to a heap overflow which allows an attacker to fill the loginPassword and loginMount buffers located in the Servent class with how much data he wants.

The version of PeerCast installed on the remote host fails to properly sanitize user-supplied data passed to the 'handShakeHTTP()' function.  An unauthenticated attacker can leverage this issue to crash the affected application and to possibly execute arbitrary code on the remote host subject to the privileges of the user running PeerCast.

The version of PeerCast installed on the remote host fails to check the length of user-supplied data in its 'handshakeHTTP' function in 'servhs.cpp' before copying it to the 'loginPassword' and 'loginMount' heap-based buffers.  An unauthenticated attacker can leverage this issue to crash the affected application or execute arbitrary code on the remote host, subject to the privileges under which PeerCast operates.

ID	Name	Product	Family	Severity
32405	Debian DSA-1583-1 : gnome-peercast - buffer overflow	Nessus	Debian Local Security Checks	critical
30139	GLSA-200801-22 : PeerCast: Buffer overflow	Nessus	Gentoo Local Security Checks	critical
29808	Debian DSA-1441-1 : peercast - buffer overflow	Nessus	Debian Local Security Checks	critical
29770	FreeBSD : peercast -- buffer overflow vulnerability (31435fbc-ae73-11dc-a5f9-001a4d49522b)	Nessus	FreeBSD Local Security Checks	critical
4318	PeerCast < 0.1218 servhs.cpp handShakeHTTP Function Remote Overflow	Nessus Network Monitor	Web Servers	high
29726	PeerCast servhs.cpp handshakeHTTP Function SOURCE Request Remote Overflow	Nessus	Peer-To-Peer File Sharing	high

Detections

Analytics

CVE-2007-6454

critical

Tenable Plugins

critical

critical

critical

critical

high

high