From: security@caldera.com
To: bugtraq@securityfocus.com, announce@lists.caldera.com,
security-alerts@linuxsecurity.com
Subject: Security Update: [CSSA-2002-020.0] Linux: icecast buffer overflows and denial-of-service
Date: Mon, 13 May 2002 14:28:15 -0700
To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com
______________________________________________________________________________
Caldera International, Inc. Security Advisory
Subject: Linux: icecast buffer overflows and denial-of-service
Advisory number: CSSA-2002-020.0
Issue date: 2002 May 10
Cross reference:
______________________________________________________________________________
1. Problem Description
Buffer overflows in the icecast server allow remote attackers
to execute arbitrary code via a long HTTP GET request, as well
as allowing denial of service attacks.
2. Vulnerable Supported Versions
System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to icecast-1.3.12-1.i386.rpm
OpenLinux 3.1 Server prior to icecast-1.3.12-1.i386.rpm
3. Solution
The proper solution is to install the latest packages.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS
4.2 Packages
83407efa0c40a9ceac02606ae37237f2 icecast-1.3.12-1.i386.rpm
4.3 Installation
rpm -Fvh icecast-1.3.12-1.i386.rpm
4.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS
4.5 Source Packages
d55ff1702ff28781cf097566e34c91c5 icecast-1.3.12-1.src.rpm
5. OpenLinux 3.1 Server
5.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS
5.2 Packages
acd0d312bcb7679c205eb5305d7d4585 icecast-1.3.12-1.i386.rpm
5.3 Installation
rpm -Fvh icecast-1.3.12-1.i386.rpm
5.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS
5.5 Source Packages
b36bf262d34fb88e9a00b695b024916e icecast-1.3.12-1.src.rpm
6. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0784
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1083
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1229
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1230
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0177
Caldera OpenLinux security resources:
http://www.caldera.com/support/security/index.html
Caldera UNIX security resources:
http://stage.caldera.com/support/security/
This security fix closes Caldera incidents sr863781, fz520848
and erg712036.
7. Disclaimer
Caldera International, Inc. is not responsible for the misuse
of any of the information we provide on this website and/or
through our security advisories. Our advisories are a service
to our customers intended to promote secure installation and
use of Caldera products.
8. Acknowledgements
The "Packet Knights" group discovered some of these
vulnerabilities.
______________________________________________________________________________