Icecast
CVE-2015-3026
MEDIUM
Severity by source
AV:N/AC:L/Au:N/C:N/I:N/A:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
AV:N/AC:L/Au:N/C:N/I:N/A:P
Lifecycle Timeline
1DescriptionCVE.org
Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to "admin/killsource?mount=/test.ogg."
AnalysisAI
Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 15.3%.
Technical ContextAI
Icecast before 2.4.2, when a stream_auth handler is defined for URL authentication, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request without login credentials, as demonstrated by a request to "admin/killsource?mount=/test.ogg." Affected products include: Xiph Icecast, Debian Debian Linux, Opensuse. Version information: before 2.4.2.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensiti
Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows l
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. Rated high severity (CVS
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today