CVE-2015-3026

Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to "admin/killsource?mount=/test.ogg."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
VendorProductVersion
xiphicecast
𝑥
≤ 2.4.1
debiandebian_linux
8.0
opensuseopensuse
13.1
opensuseopensuse
13.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
icecast2
sid
2.4.4-4
fixed
trixie
2.4.4-4
fixed
bookworm
2.4.4-4
fixed
bullseye
2.4.4-4
fixed
wheezy
not-affected
squeeze
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
icecast2
bionic
not-affected
artful
ignored
zesty
ignored
yakkety
ignored
xenial
not-affected
wily
ignored
vivid
Fixed 2.4.0-1.1+deb8u1build0.15.04.1
released
utopic
Fixed 2.3.3-2ubuntu1.14.10.1
released
trusty
Fixed 2.3.3-2ubuntu1.14.04.1
released
precise
ignored
lucid
ignored
References
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163859.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164061.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164074.html
http://lists.opensuse.org/opensuse-updates/2015-04/msg00030.html
http://lists.xiph.org/pipermail/icecast-dev/2015-April/002460.html
http://www.debian.org/security/2015/dsa-3239
http://www.openwall.com/lists/oss-security/2015/04/08/11
http://www.openwall.com/lists/oss-security/2015/04/08/8
http://www.securityfocus.com/bid/73965
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782120
https://security.gentoo.org/glsa/201508-03
https://trac.xiph.org/changeset/27abfbbd688df3e3077b535997330aa06603250f/icecast-server
https://trac.xiph.org/ticket/2191
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163859.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164061.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164074.html
http://lists.opensuse.org/opensuse-updates/2015-04/msg00030.html
http://lists.xiph.org/pipermail/icecast-dev/2015-April/002460.html
http://www.debian.org/security/2015/dsa-3239
http://www.openwall.com/lists/oss-security/2015/04/08/11
http://www.openwall.com/lists/oss-security/2015/04/08/8
http://www.securityfocus.com/bid/73965
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782120
https://security.gentoo.org/glsa/201508-03
https://trac.xiph.org/changeset/27abfbbd688df3e3077b535997330aa06603250f/icecast-server
https://trac.xiph.org/ticket/2191