CVE-2007-6454

Experiment Environment

Ubuntu 10.04 LTS

INSTALL & Configuration

wget https://github.com/mudongliang/source-packages/raw/master/CVE-2007-6454/peercast-0.1214.tar.gz
tar -xvf peercast-0.1214.tar.gz
cd peercast-0.1214
./configure
make
sudo make install

Problems in Installation & Configuration

sys.cpp:759:18: error: invalid conversion from 'const char*' to 'char*' [-fpermissive]

Use patch by patch -p1 < ../fix-const-char.patch in peercast-0.1214 directory.
Then ./configure and make.

If needed, you may be expected to use CXX="g++ -std=c++11" ./configure instead.

How to trigger vulnerability

Server:

/usr/local/bin/peercast -d

Client:

unzip peercasthof.zip
gcc -o peercastof peercastof.c
./peercastof 127.0.0.1 

PoCs

PeerCast HandshakeHTTP Multiple Buffer Overflow Vulnerabilities

PeerCast 0.12 - HandshakeHTTP Multiple Buffer Overflow Vulnerabilities

Vulnerability Patch

Root Cause

The handshakeHTTP function which handles all the requests received by the other clients is vulnerable to a heap overflow which allows an attacker to fill the loginPassword and loginMount buffers located in the Servent class with how much data he wants.

From servhs.cpp:

void Servent::handshakeHTTP(HTTP &http, bool isHTTP)
{
char *in = http.cmdLine;
...
}else if (http.isRequest("SOURCE"))
{
if (!isAllowed(ALLOW_BROADCAST))
...
mount = in+strlen(in);
while (*--mount)
if (*mount == '/')
{
mount[-1] = 0; // password preceeds
break;
}
strcpy(loginPassword,in+7);
..
if (mount)
strcpy(loginMount,mount);
...

ALLOW_BROADCAST ("allowBroadcast" in peercast.ini) is enabled by default.

Details of vulnerability are in https://www.securityfocus.com/archive/1/archive/1/485199/100/0/threaded.

Stack Trace

Patch

References