FrSIRT reports :

A vulnerability has been identified in mt-daapd which could be exploited by remote attackers to cause a denial of service or compromise an affected system. This issue is caused by a buffer overflow error in the ws_getpostvars() function when processing a negative Content-Length : header value, which could be exploited by remote unauthenticated attackers to crash an affected application or execute arbitrary code.

Three vulnerabilities have been discovered in the mt-daapd DAAP audio server (also known as the Firefly Media Server). The Common Vulnerabilities and Exposures project identifies the following three problems :

  - CVE-2007-5824     Insufficient validation and bounds checking of the     Authorization: HTTP header enables a heap buffer     overflow, potentially enabling the execution of     arbitrary code.

  - CVE-2007-5825     Format string vulnerabilities in debug logging within     the authentication of XML-RPC requests could enable the     execution of arbitrary code.

  - CVE-2008-1771     An integer overflow weakness in the handling of HTTP     POST variables could allow a heap buffer overflow and     potentially arbitrary code execution.

リモートホストは、メディアストリーミングサーバーのmt-daapdとしても知られているFirefly Media Serverを実行しています。 

リモートホストにインストールされているFirefly Media Serverのバージョンは、「src/webserver.c」の「malloc（len+1）」への呼び出しに対して使用する前に、ユーザー指定のContent-Lengthフィールドをサニタイズできないようです。認証されていないリモート攻撃者が、特別に細工されたHTTP POST content-length認証リクエストヘッダーを使用してこの問題を利用し、影響を受けるサービスをクラッシュさせたり、サービスを運用する権限の範囲内で影響を受けるシステム上で任意のコードを実行したりする可能性があります。

遠端主機正在執行 Firefly Media Server (亦稱 mt-daapd)，這是一個媒體串流伺服器。 

遠端主機上安裝的 Firefly Media Server 版本顯然未清理使用者提供的 Content-Length 欄位，便將其用於對「src/webserver.c」中「malloc(len+1)」的呼叫。未經驗證的遠端攻擊者可以使用特製的 HTTP POST content-length 要求標頭，利用此問題損毀受影響的服務，或在受影響的系統上執行任意程式碼，但這需要具有運作服務所需的權限。

远程主机正在运行 Firefly Media Server，也称为 mt-daapd，这是一款媒体流式处理服务器。 

远程主机上安装的 Firefly Media Server 版本显然未能审查用户提供的内容长度输入，便将其用于调用“src/webserver.c”的“malloc(len+1)”。使用特别构建的 HTTP POST 内容长度请求标头，未经身份验证的远程攻击者可利用此问题，导致受影响的服务崩溃，或以运行服务的特权在受影响的系统上执行任意代码。

The remote host is running Firefly Media Server, also known as mt-daapd, a media streaming server. 

The version of Firefly Media Server installed on the remote host apparently fails to sanitize user-supplied Content-Length field before using it to the call to 'malloc(len+1)' in 'src/webserver.c'. Using a specially crafted HTTP POST content-length request header, an unauthenticated, remote attacker can leverage this issue to crash the affected service or to execute arbitrary code on the affected system, subject to the privileges under which the service operates.

- Bug #442688 - CVE-2008-1771 mt-daapd: integer overflow     allowing remote DoS and possibly arbitrary code     execution

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu May 15 2008 W. Michael Petullo <mike[at]flyn.org> -     0.2.4.2-2

    - Bump epoch.

    - Wed May 14 2008 W. Michael Petullo <mike[at]flyn.org>
      - 0.2.4.2-1

    - New upstream version.

    - Remove check-input patch; it's upstream.

    - Fri Apr 18 2008 W. Michael Petullo <mike[at]flyn.org>
      - 0.9-0.2.1696

    - Apply patch by Nico Golde to fix integer overflow,       Bugzilla #442688.

    - Tue Feb 26 2008 W. Michael Petullo <mike[at]flyn.org>
      - 0.9-0.1.1696

    - New upstream version.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
32146	FreeBSD : mt-daapd -- integer overflow (86a4d810-1884-11dd-a914-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	2008/5/9	2021/1/6	high
33178	Debian DSA-1597-2 : mt-daapd - multiple vulnerabilities	Nessus	Debian Local Security Checks	2008/6/16	2021/1/4	high
32031	Firefly Media Server ws_getpostvars関数のContent-LengthヘッダーのHTTPリクエスト処理のオーバーフロー	Nessus	Gain a shell remotely	2008/4/23	2018/7/11	high
32031	Firefly Media Server ws_getpostvars 函式內容長度標頭 HTTP 要求處理溢位	Nessus	Gain a shell remotely	2008/4/23	2018/7/11	high
32031	Firefly 媒体服务器 ws_getpostvars 函数 Content-Length 标头 HTTP 请求处理溢出	Nessus	Gain a shell remotely	2008/4/23	2018/7/11	high
32031	Firefly Media Server ws_getpostvars Function Content-Length Header HTTP Request Handling Overflow	Nessus	Gain a shell remotely	2008/4/23	2018/7/11	high
32041	Fedora 8 : mt-daapd-0.9-0.4.1696.fc8 (2008-3250)	Nessus	Fedora Local Security Checks	2008/4/25	2021/1/11	high
32387	Fedora 9 : mt-daapd-0.2.4.2-2.fc9 (2008-4126)	Nessus	Fedora Local Security Checks	2008/5/20	2021/1/11	high

检测

插件搜索

high

high

high

high

high

high

high

high