Firefly Media Server ws_getpostvars Function Content-Length Header HTTP Request Handling Overflow

high Nessus Plugin ID 32031

Language:

Synopsis

The remote web server is affected by an integer overflow vulnerability.

Description

The remote host is running Firefly Media Server, also known as mt-daapd, a media streaming server.

The version of Firefly Media Server installed on the remote host apparently fails to sanitize user-supplied Content-Length field before using it to the call to 'malloc(len+1)' in 'src/webserver.c'. Using a specially crafted HTTP POST content-length request header, an unauthenticated, remote attacker can leverage this issue to crash the affected service or to execute arbitrary code on the affected system, subject to the privileges under which the service operates.

Solution

Either disable the service or upgrade to Firefly Media Server 0.2.4.2 or later.

Plugin Details

Severity: High

ID: 32031

File Name: firefly_content_overflow.nasl

Version: 1.17

Type: remote

Family: Gain a shell remotely

Published: 4/23/2008

Updated: 7/11/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:fireflymediaserver:fireflymediaserver

Exploit Ease: No known exploits are available

Reference Information

CVE: CVE-2008-1771

BID: 28860

CWE: 189

Detections

Analytics