CVE-2014-9091: Medium severity hazelcast jet vulnerability
Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors.
Other sources
It was found that when the UID and GID were changed in the <changeowner> section of the /etc/icecast.xml file, the supplementary groups were left in place. This could allow an attacker to escalate their privileges if the <changeowner> configuration was used.
The following fix was added to icecast version 2.4.0:
In case of <changeowner> only UID and GID were changed, supplementary groups were left in place. This is a potential security issue only if <changeowner> is used. New behaviour is to set UID, GID and set supplementary groups based on the UID Even in case of icecast remaining in supplementary group 0 this "only" gives it things like access to files that are owned by group 0 and according to their umask. This is obviously bad, but not as bad as UID 0 with all its other special rights. It's a security issue and we fix immediately and recommend users to update.
References: http://icecast.org/news/icecast-release-240/ https://trac.xiph.org/changeset/19137/ http://seclists.org/oss-sec/2014/q4/802
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9091?
CVE-2014-9091 is considered a high severity vulnerability due to the potential for local privilege escalation.
How do I fix CVE-2014-9091?
To fix CVE-2014-9091, upgrade to Icecast version 2.4.0 or later.
What are the potential impacts of CVE-2014-9091?
The main impact of CVE-2014-9091 is that local users may gain elevated privileges which could compromise system security.
Which versions of Icecast are affected by CVE-2014-9091?
CVE-2014-9091 affects Icecast versions prior to 2.4.0, including all versions up to 2.3.3.
Is CVE-2014-9091 easily exploitable?
CVE-2014-9091 can potentially be exploited by local users, making it a concern in multi-user environments.