Debian: DSA-089-2 Urgent Icecast Service Vulnerability Patch

Package : icecast-server
Problem type : remote root exploit (and others)
Debian-specific: no

The icecast-server (a streaming music server) package as distributed
in Debian GNU/Linux 2.2 has several security problems:

* if a client added a / after the filename of a file to be downloaded
the server would crash
* by escaping dots as %2E it was possible to circumvent security measures
and download arbitrary files
* there were several buffer overflows that could be exploited to
gain root access

These have been fixed in version 1.3.10-1, and we strongly recommend
that you upgrade your icecast-server package immediately.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.


Debian GNU/Linux 2.2 alias potato
---------------------------------

Potato was released for alpha, arm, i386, m68k, powerpc and sparc.


Source archives:

MD5 checksum: 1bc6e9ad32ac36ee3aa696433e01238e

MD5 checksum: 7274a8795e854789f42713b9ce6adfff

Alp...