CVE-2006-1148: PeerCast HTTP GET stack buffer overflow in procConnectArgs

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote unauthenticated code execution with public exploit references and very high EPSS, though not in KEV.

What it is

PeerCast before 0.1217 contains multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp, triggered by a long parameter name or value in an HTTP GET URL. The overflow occurs in the nextCGIarg function in servhs.cpp and can lead to arbitrary code execution. This is a remotely reachable flaw in a network-facing service.

Impact

A remote attacker can execute arbitrary code with the privileges of the PeerCast process. This can lead to full compromise of the affected host.

Attack surface

The flaw is reached over the network via an HTTP GET request containing an overly long parameter name or value in a URL. The CVSS vector AV:N/AC:L/Au:N indicates no authentication is required and no user interaction is needed.

Exploitation

The record is not listed in CISA KEV, but EPSS is 0.73027 (99.4th percentile) and multiple references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade PeerCast to version 0.1217 or later, which contains the fix.
• If immediate upgrade is not possible, restrict network access to the PeerCast HTTP interface to trusted hosts only.
• Apply vendor or distribution patches (e.g., Gentoo GLSA-200603-17) where available.
• Monitor for and block malformed HTTP GET requests with unusually long parameter names or values.
• Run PeerCast with least privilege to limit the impact of successful exploitation.

Detection

• Inspect HTTP request logs for GET requests with abnormally long parameter names or values targeting PeerCast.
• Use network IDS/IPS signatures for stack buffer overflow attempts against servmgr.cpp/procConnectArgs.
• Monitor PeerCast process crashes or abnormal termination that may indicate exploitation attempts.
• Watch for unexpected child processes or outbound connections from the PeerCast service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.