CVE-2007-1344 - Multiple buffer overflows in src/ezstream.c in Ezstream before 0.3.0 allow remote attackers to execu

CVE-2007-1344

Summary

Multiple buffer overflows in src/ezstream.c in Ezstream before 0.3.0 allow remote attackers to execute arbitrary code via a crafted XML configuration file processed by the (1) urlParse function, which causes a stack-based overflow and the (2) ReplaceString function, which causes a heap-based overflow. NOTE: some of these details are obtained from third party information.

References

Vulnerable Configurations

cpe:2.3:a:xiph:icecast_ezstream:-:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:-:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.1.1:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.1.1:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.1.2:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.1.2:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.1.3:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.1.3:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.2.0:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.2.0:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.2.1:*:*:*:*:*:*:*
cpe:2.3:a:xiph:icecast_ezstream:0.2.1:*:*:*:*:*:*:*

CVSS

Base:	9.3 (as of 12-07-2021 - 17:11)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:C/I:C/A:C

refmap via4

bid	22840
confirm	http://www.icecast.org/ezstream.php#ez_relnotes
osvdb	33869
secunia	24383
vupen	ADV-2007-0852
xf	ezstream-replacestring-urlparse-bo(32867)

Last major update

12-07-2021 - 17:11

Published

08-03-2007 - 22:19

Last modified

12-07-2021 - 17:11