CVE-2007-5824 webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1...
HighCVSS 7.1
EPSS 5.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| firefly media server | <= 0.2.4 | No fix listed |
References
- bugs.gentoo.org
- 28269 third-party-advisory
- 30661 third-party-advisory
- sourceforge.net
- DSA-1597 vendor-advisory
- GLSA-200712-18 vendor-advisory
- 20071102 [UPH-07-01] Firefly Media Server DoS mailing-list
- 20071102 [UPH-07-02] Firefly Media Server DoS mailing-list
- 20071102 Re: [UPH-07-01] Firefly Media Server DoS mailing-list
- 26309 vdb-entry
- firefly-getheaders-dos(38241) vdb-entry
- firefly-decodepassword-dos(38242) vdb-entry
- 4600 exploit