CVE-2025-57156
📋 TL;DR
A NULL pointer dereference vulnerability in owntone-server's DACP reply handling allows remote attackers to crash the service by sending specially crafted requests. This affects all systems running vulnerable versions of owntone-server with the HTTP/DACP interface enabled. The vulnerability results in denial of service but does not allow code execution.
💻 Affected Systems
- owntone-server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker causes persistent service crashes, rendering the music streaming service unavailable until manual restart.
Likely Case
Service crashes intermittently when malicious requests are received, causing temporary disruption to music playback and streaming functionality.
If Mitigated
With proper network segmentation and access controls, only authorized users can reach the vulnerable service, limiting attack surface.
🎯 Exploit Status
The vulnerability is in a network-facing component and requires minimal technical skill to trigger the crash.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 5e4d40ee03ae22ab79534bb1410fa9db96c9fabd
Vendor Advisory: https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md
Restart Required: Yes
Instructions:
1. Update to latest owntone-server version or apply commit 5e4d40ee03ae22ab79534bb1410fa9db96c9fabd
2. Restart the owntone-server service
3. Verify the service is running without crashes
🔧 Temporary Workarounds
Disable HTTP/DACP Interface
linuxTemporarily disable the vulnerable network interface until patching can be completed
Edit owntone.conf and set 'disable-dacp = true'
Restart service: systemctl restart owntone
Network Access Control
linuxRestrict network access to owntone-server using firewall rules
iptables -A INPUT -p tcp --dport 3689 -j DROP
ufw deny 3689
🧯 If You Can't Patch
- Implement strict network segmentation to isolate owntone-server from untrusted networks
- Deploy network-based intrusion detection to monitor for crash attempts and block malicious IPs
🔍 How to Verify
Check if Vulnerable:
Check git commit hash: git log --oneline -1 | grep -E '6d604a1|5e4d40ee'Check Version:
owntone --version 2>/dev/null || grep version /etc/owntone.confVerify Fix Applied:
Verify commit 5e4d40ee03ae22ab79534bb1410fa9db96c9fabd is present: git log --oneline | grep '5e4d40ee'📡 Detection & Monitoring
Log Indicators:
- Segmentation fault in system logs
- owntone-server crash messages
- Unexpected service restarts
Network Indicators:
- Multiple TCP connections to port 3689 followed by service unavailability
- Abnormal DACP protocol traffic patterns
SIEM Query:
source="systemd" "owntone" AND ("segmentation fault" OR "crash" OR "SIGSEGV")