CVE-2007-5824

Publication date 5 November 2007

Last updated 24 July 2024

Ubuntu priority

Description

webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
mt-daapd	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	7.10 gutsy	Ignored end of life, was needed
	7.04 feisty	Ignored end of life, was needed
	6.06 LTS dapper	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
mt-daapd	Vendor: http://www.debian.org/security/2008/dsa-1597

References

Other references

https://www.cve.org/CVERecord?id=CVE-2007-5824