SHOUTcast remote format string vulnerability

[MegaRock]

If you tested your servers at Fast-Serv they already patched their Linux copies - was working with Randy Christmas Eve. His were hex edited. The Linux version is indeed vunerable.

[DJ AmPs]

Indeed.

I just did some testing on my own and discovered that a couple of my private Linux relays running 1.9.2 (never got around to updating them) don't fall for the %n trick.

It would be much easier for some of the less tech savvy broadcasters to simply "downgrade" to 1.9.2.

[MegaRock]

Good call. Here are links to download the 1.9.2 series:

Windows:
http://www.shoutcast.com/downloads/s...-2-windows.exe

FreeBSD:
http://www.shoutcast.com/downloads/s...sd4-elf.tar.gz

Linux:
http://www.shoutcast.com/downloads/s...-glibc6.tar.gz

Mac:
http://www.shoutcast.com/downloads/s...-macosx.tar.gz

Solaris:
http://shoutcast.com/downloads/sc1-9...s-sparc.tar.gz

[WatchLive]

I got a crash even with :
iptables -A INPUT -d <ip of server> -p tcp -m length --length 0:50 --dport 8000

[DJ AmPs]

The can still crash the server with a short request. The iptables rule prevents the bindshell exploit which is a long request. Like stated a couple times in this thread, security must be applied in layers. Thers is no single magic bullet.

[angelo88]

after googling around, version 1.9.2 seems barely secure,
has the binary actually been patched for any of those bugs ?

[thetron]

Hmm Hitzradio.com just went magically down

The playlist file for Hr.com goes directly to the content folder. You'd only had to put the bit of code in. Walla server died

Doesn't seem to work with Live radio Dj'in or NVS stations

version 1.9.2 seems barely secure,

I second that!

[MegaRock]

Originally posted by DJ Killer
Well crap. Do you know what lines he had modified to prevent the exploit?

If you need an edited one let me know, I have fixed some up for a few people I know as a temporary fix until Nullsoft releases something official which from word I received is trying to be accomplished.

Note: Use PM or contact through my site. I'm not posting this in the forums as I'm sure it's against the EULA.

[Hethrir]

Hi,

I haven´t seen any answers to my previous question so I´ll try again, Sorry if I´m being pushy :-/

Am I safe if the content dir doesn´t exixt ( ./content ) And The line from the .conf file is commented out like this:

; ContentDir=./content

Thanks in advance
Hethrir

Originally posted by Hethrir
Will this affect me if the "ContentDir" line is commented out in the config ?

It´s like this in my config:

; ContentDir=./content

[Hethrir]

k ... I Changed 3 references to "/content" in the binary to s-g else

The server is running after that change.

The dir is not creates and thi Contentdir line is commented out in the conf.

is there anyone who could "test me" to se if I´m still vulnerable ?

Let me know :-)

[MegaRock]

Just download the new version from the download area. An official patched version has been released.

[WatchLive]

Did the .conf changed ? or only the sc_serv file ?
Can we still use the same .conf ?

[bingo]

Yes WatchLive, you can use the same .conf file. Only sc_serv changed.

[angelo88]

thanks MegaRock, very much appreciated for a fast response.
Let us hope that no more dumb so-called "security-aware crews" suddenly put out a public exploit before warning the
vendor or maker about a possible exploit in their software
and panicking the whole community.

[bored_womble]

I was in two minds to post this, but i thought i was worth the comment.

Although I am extremely happy that someone in AOL (Nullsoft) found time to produce a patch, top stuff guys, it would have been good if they could have released another version with the beta authentication turned on ... although it is kinda weird, may have opened up further doors for people to experiment with ? and perhaps push further than beta ?

I realise that the dev appears to be dead, but i am sure everyone here agrees it is still a top product, very simple, yet very very effective.

Anyway, thanks for the update and please ... start up the good work someone again ?

BW

[dsvahn]

My server has crashed 4 times in a 2-day period. With the exact eror. When I saw the discussion here I noticed that you were refering to the shoutcastversion 1.9.4

I'm using 1.9.5 and have the same problem.
Isn't this solved yet?

[dsvahn]

My bad, it was 1.9.4 the server used. Seems to work now with 1.9.5