CVE-2014-9091 - Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors

Back Back to CVE browser

MEDIUM

Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors

Published Dec 10, 2014

4.6

MEDIUM

CVSS 2.0

EPSS 0.49%

Description

Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-264

References (7)

http://icecast.org/news/icecast-release-2_4_0/
x_refsource_CONFIRMVendor Advisory
http://lists.opensuse.org/opensuse-updates/2014-12/msg00037.html
vendor-advisoryx_refsource_SUSE
http://seclists.org/oss-sec/2014/q4/794
mailing-listx_refsource_MLIST
http://seclists.org/oss-sec/2014/q4/802
mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=1168146
x_refsource_CONFIRM
https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-8917
Advisory
https://trac.xiph.org/changeset/19137/
x_refsource_CONFIRMExploit

Link	Providers	Tags
http://icecast.org/news/icecast-release-2_4_0/		x_refsource_CONFIRMVendor Advisory
http://lists.opensuse.org/opensuse-updates/2014-12/msg00037.html		vendor-advisoryx_refsource_SUSE
http://seclists.org/oss-sec/2014/q4/794		mailing-listx_refsource_MLIST
http://seclists.org/oss-sec/2014/q4/802		mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=1168146		x_refsource_CONFIRM
https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-8917		Advisory
https://trac.xiph.org/changeset/19137/		x_refsource_CONFIRMExploit