Tomasz Trojanowski and Damian Put have discovered a vulnerability in SHOUTcast, which potentially can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is cause due to a format string error in the URL handling within the processing of requested filenames. This can be exploited to execute arbitrary code by sending a specially crafted HTTP request containing format specifiers.

Example:
http://[victim]:8000/content/%n%n%n%n.mp3

The vulnerability has been confirmed in SHOUTcast DNAS/Linux version 1.9.4. Prior versions may also be affected.

Solution
Update to version 1.9.5.
Further details available in Customer Area

Provided and/or discovered by
Tomasz Trojanowski and Damian Put.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area