CVE-2018-18820
published 2018-11-05CVE-2018-18820: A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can…
PriorityP263high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
EPSS
48.94%
98.9th percentile
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | icecast2 | < icecast2 2.4.4-1 (bookworm) | icecast2 2.4.4-1 (bookworm) |
| xiph | icecast | < 2.4.4 | 2.4.4 |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is triggered via a crafted HTTP header sent to the URL-authentication backend of Icecast. Monitor for anomalous or oversized HTTP headers targeting Icecast URL-auth endpoints. ↗
- →The buffer overflow resides specifically in the URL-authentication backend (URL auth code) of Icecast. Detection should focus on Icecast instances with URL-auth enabled, as the backend must be enabled for exploitation. ↗
- →Patch commits for this vulnerability are available for diff-based detection rule development or to confirm patched state on a host. ↗
- ·The vulnerability only affects Icecast instances where the URL-authentication backend is explicitly enabled in configuration. Instances not using URL-auth are not exploitable. ↗
- ·Fixed in Icecast version 2.4.4. Any deployment running a version prior to 2.4.4 with URL-auth enabled should be considered vulnerable. ↗
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vendor_debian8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2018-18820: icecast2 - A buffer overflow was discovered in the URL-authentication backend of the Icecas...
vendor_debian·2018·CVSS 8.1
CVE-2018-18820 [HIGH] CVE-2018-18820: icecast2 - A buffer overflow was discovered in the URL-authentication backend of the Icecas...
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.
Scope: local
bookworm: resolved (fixed in 2.4.4-1)
bullseye: resolved (fixed in 2.4.4-1)
forky: resolved (fixed in 2.4.4-1)
sid: resolved (fixed in 2.4.4-1)
trixie: resolved (fixed in 2.4.4-1)
GHSA
GHSA-w249-6p6f-4gjq: A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2
ghsa_unreviewed·2022-05-14
CVE-2018-18820 [HIGH] CWE-119 GHSA-w249-6p6f-4gjq: A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.
OSV
CVE-2018-18820: A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2
osv·2018-11-05·CVSS 8.1
CVE-2018-18820 [HIGH] CVE-2018-18820: A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2
A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-18820 icecast: buffer overflow in URL auth code
bugzilla·2018-11-05·CVSS 8.1
CVE-2018-18820 [HIGH] CVE-2018-18820 icecast: buffer overflow in URL auth code
CVE-2018-18820 icecast: buffer overflow in URL auth code
A flaw was found in Icecast. Multiple buffer overflows in the Icecast multimedia streaming server which could result in the execution of arbitrary code.
References:
https://gitlab.xiph.org/xiph/icecast-server/issues/2342
Upstream Patch:
https://gitlab.xiph.org/xiph/icecast-server/commit/b21a7283bd1598c5af0bbb250a041ba8198f98f2
https://gitlab.xiph.org/xiph/icecast-server/commit/03ea74c04a5966114c2fe66e4e6892d11a68181e
Discussion:
Created icecast tracking bugs for this issue:
Affects: epel-all [bug 1646723]
Affects: fedora-all [bug 1646722]
---
icecast 2.4.4 version contains these fixes.
---
icecast-2.4.4-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug
Bugzilla
CVE-2018-18820 icecast: buffer overflow in URL auth code [fedora-all]
bugzilla·2018-11-05·CVSS 8.1
CVE-2018-18820 [HIGH] CVE-2018-18820 icecast: buffer overflow in URL auth code [fedora-all]
CVE-2018-18820 icecast: buffer overflow in URL auth code [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedo
Bugzilla
CVE-2018-18820 icecast: buffer overflow in URL auth code [epel-all]
bugzilla·2018-11-05·CVSS 8.1
CVE-2018-18820 [HIGH] CVE-2018-18820 icecast: buffer overflow in URL auth code [epel-all]
CVE-2018-18820 icecast: buffer overflow in URL auth code [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora E
http://www.openwall.com/lists/oss-security/2018/11/01/3http://www.securitytracker.com/id/1042019https://lists.debian.org/debian-lts-announce/2018/11/msg00033.htmlhttps://security.gentoo.org/glsa/201811-09https://www.debian.org/security/2018/dsa-4333http://www.openwall.com/lists/oss-security/2018/11/01/3http://www.securitytracker.com/id/1042019https://lists.debian.org/debian-lts-announce/2018/11/msg00033.htmlhttps://security.gentoo.org/glsa/201811-09https://www.debian.org/security/2018/dsa-4333
2018-11-05
Published