Icecast: Multiple Vulnerabilities — GLSA 201412-38

Two vulnerabilities have been found in Icecast, possibly resulting in privilege escalation or disclosure of information.

Affected packages

net-misc/icecast on all architectures
Affected versions < 2.4.1
Unaffected versions >= 2.4.1

Background

Icecast is an open source alternative to SHOUTcast that supports MP3, OGG (Vorbis/Theora) and AAC streaming.

Description

Two vulnerabilities have been discovered in Icecast:

  • Icecast does not properly handle shared file descriptors (CVE-2014-9018)
  • Supplementary group privileges are not changed (CVE-2014-9091)

Impact

A local attacker can possibly gain escalated privileges or obtain sensitive information.

Workaround

There is no known workaround at this time.

Resolution

All Icecast users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-misc/icecast-2.4.1"
 

References

Release date
December 26, 2014

Latest revision
December 26, 2014: 1

Severity
high

Exploitable
local, remote

Bugzilla entries