CVE-2025-63647
📋 TL;DR
A NULL pointer dereference vulnerability in owntone-server's parse_meta function allows attackers to crash the server by sending a specially crafted DAAP request, causing denial of service. This affects all systems running vulnerable versions of owntone-server with DAAP service enabled.
💻 Affected Systems
- owntone-server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of owntone-server, disrupting media streaming services until manual restart.
Likely Case
Service crash requiring manual intervention to restore functionality.
If Mitigated
Minimal impact if server is behind proper network controls and not exposed to untrusted networks.
🎯 Exploit Status
Exploit requires network access to DAAP port (default 3689).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 53ee9a3c3921e5448f502800c4dfa787865f6cb7 or later
Vendor Advisory: https://github.com/owntone/owntone-server/commit/53ee9a3c3921e5448f502800c4dfa787865f6cb7
Restart Required: Yes
Instructions:
1. Update to latest owntone-server version from GitHub. 2. Rebuild from source if using source installation. 3. Restart the owntone-server service.
🔧 Temporary Workarounds
Disable DAAP Service
linuxTemporarily disable the DAAP protocol to prevent exploitation.
Edit owntone configuration to set 'disable-daap = true' and restart service
Network Access Control
linuxRestrict access to DAAP port (3689) using firewall rules.
sudo iptables -A INPUT -p tcp --dport 3689 -j DROP
sudo iptables -A INPUT -p udp --dport 3689 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate owntone-server from untrusted networks.
- Deploy intrusion detection/prevention systems to monitor for DAAP protocol anomalies.
🔍 How to Verify
Check if Vulnerable:
Check if running version before commit 53ee9a3c3921e5448f502800c4dfa787865f6cb7 and DAAP service is enabled.Check Version:
owntone --version or check git commit hash in installation directoryVerify Fix Applied:
Verify current version includes commit 53ee9a3c3921e5448f502800c4dfa787865f6cb7 and test DAAP service functionality.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in system logs
- Unexpected owntone-server crashes
- DAAP request parsing errors
Network Indicators:
- Unusual traffic patterns to port 3689
- Malformed DAAP protocol packets
SIEM Query:
source="owntone.log" AND ("segmentation fault" OR "crash" OR "parse_meta")