A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.

The remote host is affected by the vulnerability described in GLSA-201811-09 (Icecast: Arbitrary code execution)

    Multiple buffer overflows have been discovered in Icecast. Please review       the CVE identifier referenced below for details.
  Impact :

    A remote attacker, by sending a specially crafted request using       authentication type &ldquo;url&rdquo;, could possibly execute arbitrary code with       the privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for icecast fixes the following security issues :

  - CVE-2018-18820: A buffer overflow in url-auth could have     potentially allowed remote code execution (boo#1114434)

This release fixes buffer overflows in URL authentication code (CVE-2018-18820), a crash in htpasswd authentication if no filename is set, a crash on xsltApplyStylesheet() error, and a crash on malformed Opus streams. It also corrects global listener counter. It stops displaying hashed user passwords for security concerns. It adds support for announcing Opus streams to YP catalogs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow was discovered in the URL-authentication backend of the icecast2, the popular open source streaming media server. If the backend is enabled, then any malicious HTTP client can send a request for specific resource including a crafted header which can overwrite the server's stack contents, leading to denial of service and potentially remote code execution.

For Debian 8 'Jessie', this problem has been fixed in version 2.4.0-1.1+deb8u2.

We recommend that you upgrade your icecast2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Nick Rolfe discovered multiple buffer overflows in the Icecast multimedia streaming server which could result in the execution of arbitrary code.

ID	Name	Product	Family	Severity
124215	GLSA-201811-09 : Icecast: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
123170	openSUSE Security Update : icecast (openSUSE-2019-360)	Nessus	SuSE Local Security Checks	high
120825	Fedora 28 : icecast (2018-d4349a7ba3)	Nessus	Fedora Local Security Checks	high
120734	Fedora 29 : icecast (2018-b881073c43)	Nessus	Fedora Local Security Checks	high
119151	Debian DLA-1588-1 : icecast2 security update	Nessus	Debian Local Security Checks	high
118951	openSUSE Security Update : icecast (openSUSE-2018-1395)	Nessus	SuSE Local Security Checks	high
118899	Fedora 27 : icecast (2018-f3d995c6a8)	Nessus	Fedora Local Security Checks	high
118722	Debian DSA-4333-1 : icecast2 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-18820

high

Tenable Plugins

high

high

high

high

high

high

high

high