Firefly Media Server webserver.c ws_addarg Function /xml-rpc Authorization Header Remote Format String

high Nessus Plugin ID 27619

Language:

Synopsis

The remote web server is affected by a format string vulnerability.

Description

The remote host is running Firefly Media Server, also known as mt-daapd, a media streaming server.

The version of Firefly Media Server installed on the remote host apparently fails to sanitize user-supplied input before using it as the format string in a call to 'vsnprintf'' in 'src/webserver.c'. Using a specially crafted HTTP Authorization request header, an unauthenticated, remote attacker can leverage this issue to crash the affected service or to execute arbitrary code on the affected system, subject to the privileges under which the service operates.

Solution

Either disable the service or upgrade to Firefly Media Server 0.2.4.1 or later.

Plugin Details

Severity: High

ID: 27619

File Name: firefly_format_string.nasl

Version: 1.21

Type: remote

Family: Gain a shell remotely

Published: 11/3/2007

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:firefly:media_server

Exploit Available: true

Exploit Ease: Exploits are available

Exploitable With

Core Impact

Reference Information

CVE: CVE-2007-5825

BID: 26310

CWE: 134

Detections

Analytics