Icecast: Denial of service

Background

Icecast is an open source alternative to shoutcast that supports mp3, ogg (vorbis/theora) and aac streaming.

Description

When stream_auth handler is defined for URL authentication and a request is sent without login credentials, a Denial of Service condition can occur.

Impact

A remote attacker could possibly cause a Denial of Service condition.

Workaround

Users of affected versions can change stream_auth mountpoints to use password authentication instead.

Resolution

All icecast users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-misc/icecast-2.4.2"