CVE-2002-0907 in SHOUTcast Server
Summary
by MITRE
Buffer overflow in SHOUTcast 1.8.9 and other versions before 1.8.12 allows a remote authenticated DJ to execute arbitrary code on the server via a long value in a header whose name begins with "icy-".
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/11/2025
The vulnerability identified as CVE-2002-0907 represents a critical buffer overflow flaw affecting SHOUTcast server software versions prior to 1.8.12. This issue specifically targets the handling of HTTP headers within the streaming media server implementation, creating a pathway for remote code execution that can be exploited by authenticated DJs. The vulnerability resides in the server's insufficient input validation mechanisms when processing header values that begin with the "icy-" prefix, which is commonly used in SHOUTcast's streaming protocol for metadata transmission and server communication. The flaw demonstrates a classic buffer overflow condition where the server fails to properly bounds-check data before copying it into fixed-length memory buffers, allowing attackers to overwrite adjacent memory regions and potentially execute malicious code with the privileges of the SHOUTcast service account.
The technical exploitation of this vulnerability requires an authenticated DJ connection to the SHOUTcast server, as the attack vector specifically targets header processing within the DJ authentication flow. Attackers can craft malicious HTTP requests containing specially formatted header values that exceed the allocated buffer space, causing a stack overflow condition that can be manipulated to redirect program execution flow. The "icy-" prefix in header names is significant because it identifies SHOUTcast-specific metadata headers that are processed by the server's streaming engine. According to CWE classification, this vulnerability maps to CWE-121, which describes heap-based buffer overflow conditions, and CWE-787, which covers out-of-bounds write vulnerabilities. The attack pattern aligns with ATT&CK technique T1059.007 for command and scripting interpreter, as successful exploitation would enable arbitrary code execution on the target system. The vulnerability's impact extends beyond simple code execution to potentially allow full system compromise, given that SHOUTcast servers often run with elevated privileges and may be connected to critical network infrastructure.
The operational impact of CVE-2002-0907 is severe for organizations operating SHOUTcast streaming services, as it creates a persistent security risk that can be exploited by authorized users with minimal technical expertise. The vulnerability affects not only the immediate server compromise but also potentially exposes the entire network infrastructure to further attacks, as compromised streaming servers often serve as launch points for broader network penetration attempts. Organizations running vulnerable versions of SHOUTcast are particularly at risk because the attack requires only authenticated access, which is typically granted to legitimate DJs who may not be properly vetted or monitored for malicious activity. The vulnerability's longevity and the fact that it affects versions released in 2002 demonstrate how poorly implemented security controls can persist for years, creating extended attack windows. Network defenders must consider this vulnerability alongside other legacy software security issues, as SHOUTcast servers may be part of larger multimedia infrastructure that includes additional interconnected systems. The exploitation of this vulnerability also highlights the importance of proper input validation and bounds checking in network services, particularly those handling user-supplied data through HTTP headers. Organizations should implement immediate patching procedures for all affected systems and consider network segmentation to limit the potential impact of successful exploitation attempts.