Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to "admin/killsource?mount=/test.ogg."

- update to 2.4.2

    - fix CVE-2015-3026

    - use %license on Fedora 22+

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- update to 2.4.2

    - fix CVE-2015-3026

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201508-03 (Icecast: Denial of Service)

    When stream_auth handler is defined for URL authentication and a request       is sent without login credentials, a Denial of Service condition can       occur.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    Users of affected versions can change stream_auth mountpoints to use       password authentication instead.

Juliane Holzt discovered that Icecast2, a streaming media server, could dereference a NULL pointer when URL authentication is configured and the stream_auth URL is trigged by a client without setting any credentials. This could allow remote attackers to cause a denial of service (crash).

The streaming server icecast was updated to fix a remote denial of service vulnerability.

A remote attacker could crash icecast and cause denial of service when URL Auth is configured and used with stream_auth without credentials (bnc#926402 CVE-2015-3026)

ID	Name	Product	Family	Severity
85552	Fedora 22 : icecast-2.4.2-1.fc22 (2015-13083)	Nessus	Fedora Local Security Checks	medium
85551	Fedora 21 : icecast-2.4.2-1.fc21 (2015-13077)	Nessus	Fedora Local Security Checks	medium
85431	GLSA-201508-03 : Icecast: Denial of Service	Nessus	Gentoo Local Security Checks	medium
85423	Fedora 23 : icecast-2.4.2-1.fc23 (2015-13106)	Nessus	Fedora Local Security Checks	medium
83145	Debian DSA-3239-1 : icecast2 - security update	Nessus	Debian Local Security Checks	medium
82845	openSUSE Security Update : icecast (openSUSE-2015-310)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2015-3026

high

Tenable Plugins

medium

medium

medium

medium

medium

medium