Description
Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a large number of headers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | icecast2 | 2.0.2.debian-1 | — |
| Debian 12 | icecast2 | 2.0.2.debian-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Icecast Header Overwrite
exploit/windows/http/icecast_header
Exploit-DB 3
- Icecast 2.0.1 (Windows x86) - Header Overwrite (Metasploit) EDB-16763 · remote · Apr 30, 2010 · verified
- Icecast 2.0.1 (Win32) - Remote Code Execution (2) EDB-573 · remote · Oct 12, 2004 · verified
- Icecast 2.0.1 (Win32) - Remote Code Execution (1) EDB-568 · remote · Oct 6, 2004 · verified
GitHub 6 repositories
-
ivanitlearning/CVE-2004-1561 ★ 7 · Mar 27, 2020
Icecast Header Overwrite buffer overflow RCE < 2.0.1 (Win32)
-
thel1nus/CVE-2004-1561-Notes ★ 3 · May 28, 2021
My notes for CVE-2004-1561 IceCast exploitation
-
darrynb89/CVE-2004-1561 ★ 1 · Jun 22, 2020
Python version of Metasploit exploit for CVE-2004-1561
-
MonseigneurPatas/thm-ice-icecast-rce-privesc ★ 0 · Jun 21, 2026
Full compromise of TryHackMe's Ice machine — Icecast 2.0.1 RCE (CVE-2004-1561) via buffer overflow, followed by Windows privilege escalation through UAC bypass / COM hijacking. Includes detailed meth…
-
ratiros01/CVE-2004-1561 ★ 0 · Jun 9, 2020
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 11271 vdb-entry
- http://aluigi.altervista.org/adv/iceexec-adv.txt
- 12666 third-party-advisory
- 1011439 vdb-entry
- 20040928 Code execution in Icecast 2.0.1 mailing-list
- 10446 vdb-entry
- http://www.securiteam.com/exploits/6X00315BFM.html
- 20041002 Re:2. Code execution in Icecast 2.0.1(exploit with shellcode) mailing-list
- icecast-http-bo(17538) vdb-entry