CVE-2014-9018 : Icecast before 2.4.1 transmits the output of the on-connect script, which might

Icecast before 2.4.1 transmits the output of the on-connect script, which might allow remote attackers to obtain sensitive information, related to shared file descriptors.

Published 2014-12-03 18:59:08

Updated 2017-09-08 01:29:32

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2014-9018

Icecast » Icecast
Versions up to, including, (<=) 2.4.0
cpe:2.3:a:icecast:icecast:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2014-9018

Top countries where our scanners detected CVE-2014-9018

Top open port discovered on systems with this issue 8000

IPs affected by CVE-2014-9018 957

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2014-9018!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2014-9018

EPSS FAQ

2.67%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 91 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-9018

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2014-9018

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-9018

https://exchange.xforce.ibmcloud.com/vulnerabilities/98991

Icecast /etc/icecast.xml privilege escalation CVE-2014-9091 Vulnerability Report
http://www.mandriva.com/security/advisories?name=MDVSA-2014:231

mandriva.com
http://www.securityfocus.com/bid/71312

Icecast CVE-2014-9091 Local Privilege Escalation Vulnerability
https://trac.xiph.org/ticket/2089

#2089 ([duplicate] icecast sends output of <on-connect> script to source client) – Xiph
http://www.openwall.com/lists/oss-security/2014/11/19/23

oss-security - CVE request: icecast: possible leak of on-connect scripts
Exploit
http://lists.opensuse.org/opensuse-updates/2014-12/msg00038.html

openSUSE-SU-2014:1593-1: moderate: Security update for icecast
http://www.openwall.com/lists/oss-security/2014/11/20/22

oss-security - Re: CVE request: icecast: possible leak of on-connect scripts
Exploit
http://icecast.org/news/icecast-release-2_4_1/

Icecast Release 2.4.1 — Icecast
https://trac.xiph.org/ticket/2087

#2087 (icecast does not only write the stream data into the dumpfile) – Xiph
Exploit