Fenice <= 1.10 Multiple Remote Vulnerabilities

high Nessus Plugin ID 21610

Language:

Synopsis

The remote RTSP server suffers from multiple overflow issues.

Description

The remote host is running Fenice, an open source media streaming server for Linux / Unix.

The version of Fenice installed on the remote host is affected by an integer overflow vulnerability involving requests with large values for the 'Content-Length' header and by a buffer overflow vulnerability in its 'parse_url' function. An unauthenticated, remote attacker can exploit either flaw using a simple GET request to crash the affected application and possibly to execute arbitrary code subject to the privileges of the user id under which Fenice runs.

Solution

Upgrade to Fenice version 1.11 or later.

Plugin Details

Severity: High

ID: 21610

File Name: fenice_110.nasl

Version: 1.17

Type: remote

Family: Gain a shell remotely

Published: 5/27/2006

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:ls3:fenice

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/6/2006

Vulnerability Publication Date: 4/23/2006

Reference Information

CVE: CVE-2006-2022, CVE-2006-2023

BID: 17678

Detections

Analytics