CVE-2008-0550
published 2008-02-01CVE-2008-0550: Off-by-one error in Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a certain…
PriorityP357critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
53.78%
98.9th percentile
Off-by-one error in Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a certain HTTP request that leads to a buffer overflow, as demonstrated by a long User-Agent header.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| radio_toolbox | steamcast | <= 0.9.75 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
BadChars: \x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c
- →Detect exploit by matching HTTP GET requests with a User-Agent header of approximately 1008+ bytes targeting port 8000, characteristic of the Steamcast overflow. ↗
- →Fingerprint vulnerable Steamcast instances by checking HTTP banner responses for the string 'Steamcast/0.9.75'. ↗
- →Exploit payload uses AlphanumUpper encoding; detect alphanumeric-only shellcode in the User-Agent header as a strong indicator of exploitation. ↗
- →The exploit appends a short JMP (jmp_short(6)) and two NOPs followed by a 4-byte return address and a CALL-back offset after the payload; this byte pattern in the User-Agent is a reliable exploit signature. ↗
- →The exploit appends 275 bytes of random uppercase alpha padding after the return address; a User-Agent of total length ~1300 bytes is characteristic of this attack. ↗
- ·Return addresses are OS-specific; 0x75022ac4 targets Windows 2000 Pro English All and 0x71aa32ad targets Windows XP Pro SP0/SP1 English only — detections based on these values will not cover other OS variants. ↗
- ·The Metasploit module defaults to target index 1 (Windows XP Pro SP0/SP1 English); detections should prioritise that return address but also cover the Windows 2000 variant. ↗
- ·EXITFUNC is set to 'thread', meaning the exploit spawns a thread for the payload and the main daemon process may survive, potentially making crash-based detection unreliable. ↗
- ·Payload space is limited to 750 bytes and NOPs fill the remainder of the 1008-byte User-Agent field; payload size alone is not sufficient for detection without also checking for the NOP sled. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Streamcast 0.9.75 - HTTP User-Agent Buffer Overflow (Metasploit)
exploitdb·2010-06-11
CVE-2008-0550 Streamcast 0.9.75 - HTTP User-Agent Buffer Overflow (Metasploit)
Streamcast 0.9.75 - HTTP User-Agent Buffer Overflow (Metasploit)
---
##
# $Id: steamcast_useragent.rb 9488 2010-06-11 16:12:05Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Streamcast %q{
This module exploits a stack buffer overflow in Streamcast [
'LSO ', # Original exploit module
'patrick' # Added references and check code. Default target to XP.
],
'License' => BSD_LICENSE,
'Version' => '$Revision: 9488 $',
'References' =>
[
[ 'CVE', '2008-0550' ],
[ 'OSVDB', '42670' ],
[ 'URL', 'http://aluigi.altervista.org/adv/steamcazz-adv.
Metasploit
Streamcast HTTP User-Agent Buffer Overflow
metasploit
Streamcast HTTP User-Agent Buffer Overflow
Streamcast HTTP User-Agent Buffer Overflow
This module exploits a stack buffer overflow in Streamcast <= 0.9.75. By sending an overly long User-Agent in an HTTP GET request, an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
2008-02-01
Published