Format string vulnerability in the ws_addarg function in webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to execute arbitrary code via a stats method action to /xml-rpc with format string specifiers in the (1) username or (2) password portion of base64-encoded data on the Authorization: Basic HTTP header line.
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Media_server | Firefly | 0.2.4 (including) | 0.2.4 (including) |
| Mt-daapd | Ubuntu | feisty | * |
| Mt-daapd | Ubuntu | gutsy | * |
| Mt-daapd | Ubuntu | upstream | * |