Streamripper "httplib_parse_sc_header()" Buffer Overflows - Advisories

Software Inspectors

	Scan Online

	Personal (PSI)

	Network (NSI 2.0)

Solutions For

	Security Professionals

	Security Vendors

Free Solutions For

	Open Communities

	Journalists & Media

Secunia Advisories

	Search

	Historic Advisories

	Listed By Product

	Listed By Vendor

	Statistics / Graphs

	Secunia Research

	Report Vulnerability

	About Advisories

Virus Information

	Chronological List

	Last 10 Virus Alerts

	About Virus Information

Secunia Customers

	Customer Area

Streamripper "httplib_parse_sc_header()" Buffer Overflows

Secunia Advisory:	SA26406
Release Date:	2007-08-13
Last Update:	2007-09-14

Critical:	Moderately critical
Impact:	System access
Where:	From remote
Solution Status:	Vendor Patch

Software:	Streamripper 1.x

CVE reference:	CVE-2007-4337 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: Some vulnerabilities have been reported in Streamripper, which can be exploited by malicious people to compromise a user's system. The vulnerabilities are caused due to boundary errors within the "httplib_parse_sc_header()" function when handling certain HTTP headers (e.g. "Server", "Location"). These can be exploited to cause a buffer overflow by e.g. tricking the user into connecting to a malicious server. The vulnerabilities are reported in versions prior to 1.62.2. Solution: Update to version 1.62.2. http://sourceforge.net/project/showfiles.php?group_id=6172 Provided and/or discovered by: Chris Rohlf Changelog: 2007-08-14: Updated advisory based on information from Chris Rohlf. 2007-09-14: Added CVE reference. Original Advisory: http://sourceforge.net/project/shownotes.php?group_id=6172&release_id=531738 http://em386.blogspot.com/2007/08/streamripper-buffer-overflows.html http://chris.rohlf.googlepages.com/Streamripper_1.62.1_Stack_Overflows.txt



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

1 Related Secunia Security Advisories

1. Streamripper HTTP Header Buffer Overflow Vulnerabilities

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	Apple Safari Cross-Domain Cookie Injection Vulnerability

2.	YouTube Blog Multiple Vulnerabilities

3.	dnsmasq Denial of Service and DNS Cache Poisoning

4.	Moodle Script Insertion and Cross-Site Request Forgery

5.	Asterisk Two Denial of Service Vulnerabilities

6.	Ubuntu update for dnsmasq

7.	Claroline Multiple Cross-Site Scripting Vulnerabilities

8.	Geeklog Forum Plugin Search Cross-Site Scripting Vulnerability

9.	IPCop update for various packages

10.	SocialEngine SQL Injection and Code Execution