Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.3666
[DLA-1588-1] icecast2 security update
27 November 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: icecast2
Publisher: Debian
Operating System: Debian GNU/Linux 8
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2018-18820
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2018/11/msg00033.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running icecast2 check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Package : icecast2
Version : 2.4.0-1.1+deb8u2
CVE ID : CVE-2018-18820
Debian Bug : 912611
A buffer overflow was discovered in the URL-authentication backend of
the icecast2, the popular open source streaming media server. If the
backend is enabled, then any malicious HTTP client can send a request
for specific resource including a crafted header which can overwrite
the server's stack contents, leading to denial of service and
potentially remote code execution.
For Debian 8 "Jessie", this problem has been fixed in version
2.4.0-1.1+deb8u2.
We recommend that you upgrade your icecast2 packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE7xPqJqaY/zX9fJAuhj1N8u2cKO8FAlv7+wMACgkQhj1N8u2c
KO+eiw//QXEeGDc6vBF1MvdS18nb4obl0mvBTvw1wsEVO6feRfHoKgwe/gbis04I
djUt9d6+LJQHCsRM/LceQ8aZqAYReKh8HvQTtS1N1R8OUCwM3fsVMZPM5zH0yUx3
gPP46Lp2AWld+N4MDttfYgMD5Jb1BxZCLgnRy8Im7SgQy9J8D6FeDkkYhosGaddc
PthldI02Zt7bvn/P3JtLjtQq6Ebt4BIRh6kzr4w4gR1FQDAtLtvMre7ydDLqH7ab
mVTTrhpdCAlIwsxqnBbydcYOkNPiiQyU/P4CxqGOk+0rlSqn811SABJBTa/Ywc9y
jc2uRGGT5XZoqb7eHhSDGzAGlrJerr/utQYSu5HzhoKd8GNITxVxsMzHT3XDtbnf
Iq1kNj/YI/BNQysAmzDamhQK5E7fcRNDnzD1H7Dqp+2c43JcIdHwpG9oKgx9C92w
bPnJQDibenjr/3Gb7BcGznnauii2/tW1zYuKdc2h+jj491d3Po7i1hLb3Z1y3pH7
kXCDnp/z3BRZpO3boFvMCdHZTrlD0RbWwtd/QyjvZ3uuwzGvAASwNuz0g/SMqy/C
EywDEbIx6rsWso+xjM+UYTItX1sb6sfFnSjnnrQ1FeBoFWEZbgb5yqmxwuCH17PM
74wwJfdyAFJNx1o3BJgdW1r8UWS+ll1Wt963gJ6T2sI3NBqgNZ0=
=K7iP
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW/yN3WaOgq3Tt24GAQjWBA/+LOi/IP0wfIe/PPwbDU6bvB3vxTtRIFwW
nnLMi4vp+tLSlKqelHDjXYKGLUaL8eCrw7+LerIHjscPFLPiNNqGr12XwobtIicX
uM40Yuw1Wogc/T3wOwgQ7W4zQsc2TgHUPxeJEhmgzNM+tmNvorjT+jO4U1uEGi3R
xN5FHV7aSAcBuLdHn404iubC4r/el0kakF5/S2ulYrOu/5kRG9QkSFSG+2Hbmh0p
5ypoNu4Ew7/DvaVhirXhVwnDS6/TJFcDgMvzpGcS49WKC8bJj6yBYXwVi5HbhVh3
fY953p+P0zwwxmwwd6PjVbkDxyAP/4Olx+GDEauCLIRE5xOdMG4jzIbHkQfpb4KZ
GSm5JqacgiNcQjCzBNkJ2opjWh1cKY8CJlWE6VgK4h2f9uZMaKTRrskjvDJu/itB
wXGuN91QUjpBhYq/+6wRDzyWNrjowTk8lTSpX5CHDgP+obVGTdmMnU8vIy+JzWgC
olXuh2MFbsUWsipWR4wBYTG1huieLwmtQUrivaUaguJNx+/kRkQOhTGpIllHOd3K
YY5I4PuyY2Ev24ZYKctB8nkmXm0UGU5/voMrrx8HlPVI5aP7iWEU4r6KKla5U6nz
OTWkOeIMKdg+BvgrqfNuAwQnWqmLLoN4cF4hmXrwiZX5XFgR7+zwXrHfuXrPAc2h
9bcmyoAihHM=
=orsa
-----END PGP SIGNATURE-----