Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.

The remote host is affected by the vulnerability described in GLSA-201412-38 (Icecast: Multiple Vulnerabilities)

    Two vulnerabilities have been discovered in Icecast:
      Icecast does not properly handle shared file descriptors         (CVE-2014-9018)       Supplementary group privileges are not changed (CVE-2014-9091)   Impact :

    A local attacker can possibly gain escalated privileges or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

**fix CVE-2014-9091 (#1168146, #1168147, #1168148, #1168149)** **fix CVE-2014-9018 (#1165880, #1165882, #1165883, #1165885)** **enabled fully hardened build (#954320)**

  - update new to release v2.4.1 (#1101950)

    - added doc-subpkg

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

icecast was updated to fix one security issue.

This security issue was fixed :

  - Possible leak of on-connect scripts (CVE-2014-9018).

icecast was updated to fix two security issues.

These security issues were fixed :

  - Supplementary groups were not overriden (CVE-2014-9091).

  - Possible leak of on-connect scripts (CVE-2014-9018).

Updated icecast package fixes security vulnerability :

Icecast did not properly handle the launching of scripts on connect or disconnect of sources. This could result in sensitive information from these scripts leaking to (external) clients (CVE-2014-9018).

ID	Name	Product	Family	Severity
80243	GLSA-201412-38 : Icecast: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
79949	Fedora 19 : icecast-2.4.1-1.fc19 (2014-16483)	Nessus	Fedora Local Security Checks	medium
79945	Fedora 21 : icecast-2.4.1-1.fc21 (2014-16435)	Nessus	Fedora Local Security Checks	medium
79941	Fedora 20 : icecast-2.4.1-1.fc20 (2014-16394)	Nessus	Fedora Local Security Checks	medium
79817	openSUSE Security Update : icecast (openSUSE-SU-2014:1593-1)	Nessus	SuSE Local Security Checks	medium
79816	openSUSE Security Update : icecast (openSUSE-SU-2014:1591-1)	Nessus	SuSE Local Security Checks	medium
79611	Mandriva Linux Security Advisory : icecast (MDVSA-2014:231)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2014-9018

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium