VANED LABS: icecast filesystem disclosure

listdirectory makes no effort to constrain the request to the static directory. Icecast allows for remote probing of the underlying filesystem structure. on a side note, this can also be used to list files with a .mp3 extension anywhere on the system. sendfile does do traversal checking. nc...

Multiple bugs in icecast.

It's possible to cause server's DoS and access mp3 files in any directory...

Icecast list_directory Function Traversal File/Directory Enumeration

The remote server does not return the same error codes when it is requested a nonexistent directory and an existing one. An attacker may use this flaw to deduct the presence of several key directory on the remote server, and therefore gain further knowledge about it. %NASLMINLEVEL 70300 C Tenable...

icecast server 1.3.12 - Directory Traversal Information Disclosure

icecast server 1.3.12 - Directory Traversal Information Disclosure source: https://www.securityfocus.com/bid/5189/info Icecast is a freely available, open source streaming audio server. Icecast is available for the Unix, Linux, and Microsoft Windows platforms. An attacker may exploit a directory...

icecast server 1.3.12 - Directory Traversal Information Disclosure

source: https://www.securityfocus.com/bid/5189/info Icecast is a freely available, open source streaming audio server. Icecast is available for the Unix, Linux, and Microsoft Windows platforms. An attacker may exploit a directory traversal vulnerability in Icecast server to determine the existanc...

CVE-2001-1083

Icecast 1.3.7, and other versions before 1.3.11 with HTTP server file streaming support enabled allows remote attackers to cause a denial of service crash via a URL that ends in . dot, / forward slash, or \ backward slash...

CVE-2001-1083

Icecast versions 1.3.7 and earlier (including 1.3.7 and other

icecast 1.x multiple vulnerabilities

icecast 1.3.11 and earlier contained numerous security vulnerabilities, the most severe allowing a remote attacker to execute arbitrary code as root...

CVE-2002-0177

Buffer overflows in icecast 1.3.11 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client...

CVE-2002-0177

Buffer overflows in icecast 1.3.11 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client...

CVE-2001-1230

CVE-2001-1230 affects Icecast before 1.3.10. The OpenVAS/NVD data describe a remote buffer overflow in Icecast that allows a remote attacker to crash the server and potentially execute arbitrary code with the server’s privileges. Several advisories (e.g., Debian DSA-089-1/DSA-089-2) and OpenVAS p...

CVE-2001-1229

Buffer overflows in 1 Icecast before 1.3.9 and 2 libshout before 1.0.4 allow remote attackers to cause a denial of service crash and execute arbitrary code...

CVE-2001-1230

Buffer overflows in Icecast before 1.3.10 allow remote attackers to cause a denial of service crash and execute arbitrary code...

CVE-2002-0177

Summary: CVE-2002-0177 affects Icecast 1.3.11 and earlier, allowing remote attackers to execute arbitrary code via a long HTTP GET request from an MP3 client due to a remote buffer overflow. Affected product/version: Icecast, version

CVE-2001-1229

CVE-2001-1229 affects Icecast before 1.3.9 and libshout before 1.0.4. A remote attacker can trigger a buffer/stack overflow to crash the server or execute arbitrary code. OpenVAS entries confirm a remote overflow in Icecast/libshout; recommended remediation is upgrading Icecast to at least 1.3.9 ...

icecast 1.3.11 remote shell/root exploit - #temp

Ola, I'm feeling rather homicidal today so I'm killing a bug. I hope it has a nice funeral. It has been a good friend to all of us. May it rest in peace. There is a remotely exploitable buffer overflow in all versions of the Icecast mp3 streaming server www.icecast.org. All means that yes, the...

Remote root buffer overflow in Icecast server

Stack overflow on long GET request...

CVE-2001-0784

CVE-2001-0784 refers to a directory traversal flaw in Icecast 1.3.10 and earlier. The OpenVAS/Nessus-derived data confirms that an attacker can use specially crafted URLs to read arbitrary files on the affected system due to insufficient input sanitization. The vulnerability affects Icecast’s web...

CVE-2001-0784

Directory traversal vulnerability in Icecast 1.3.10 and earlier allows remote attackers to read arbitrary files via a modified .. dot dot attack using encoded URL characters...

Icecast 1.x - AVLLib Buffer Overflow

Icecast 1.x - AVLLib Buffer Overflow // source: https://www.securityfocus.com/bid/4415/info Icecast is a freely available, open source streaming audio server. Icecast is available for the Unix, Linux, and Microsoft Windows platforms. Icecast does not properly check bounds on data sent from client...