[ GLSA 200506-15 ] PeerCast: Format string vulnerability

[GLSA]

Gentoo Linux Security Advisory

Title: PeerCast: Format string vulnerability (GLSA 200506-15)
Severity: high
Exploitable: remote
Date: June 19, 2005
Updated: May 22, 2006
Bug(s): #96199
ID: 200506-15

Synopsis


PeerCast suffers from a format string vulnerability that could allow
arbitrary code execution.


Background


PeerCast is a media streaming system based on P2P technology.


Affected Packages

Package: media-sound/peercast
Vulnerable: < 0.1212
Unaffected: >= 0.1212
Architectures: All supported architectures


Description


James Bercegay of the GulfTech Security Research Team discovered that
PeerCast insecurely implements formatted printing when receiving a
request with a malformed URL.


Impact


A remote attacker could exploit this vulnerability by sending a request
with a specially crafted URL to a PeerCast server to execute arbitrary
code.


Workaround


There is no known workaround at this time.


Resolution


All PeerCast users should upgrade to the latest available version: