MeeGo alert MeeGo-SA-10:04 (libmikmod)

From:
    	     
 
"Ware, Ryan R" <ryan.r.ware@intel.com> 
To:
    	     
 
"meego-security@meego.com" <meego-security@meego.com> 
Subject:
    	     
 
[MeeGo-security] [MeeGo-SA-10:04.libmikmod] Heap overflow in
	libmikmod 
Date:
    	     
 
Wed, 7 Jul 2010 13:58:43 -0700
Message-ID:
    	     
 
<C85A3893.14E21%ryan.r.ware@intel.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
==
MeeGo-SA-10:04.libmikmod               Security Advisory
                                                                MeeGo
Project

Topic:          Heap overflow in libmikmod

Category:       Mikmod MOD music player
Module:         libmikmod
Announced:      July 7, 2010
Affects:        MeeGo 1.0
Corrected:      July 7, 2010
MeeGo BID: 2509
CVE:  CVE-2009-3996

For general information regarding MeeGo Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://www.MeeGo.com/>.

I.   Background

libmikmod is a library used by the mikmod MOD music file player for
UNIX-like systems. Supported file formats include MOD, STM, S3M,
MTM, XM, ULT and IT.

II.  Problem Description

Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder
Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow
remote attackers to execute arbitrary code via an Ultratracker file.
CVSS v2 Base: 9.3 (HIGH)
Access Vector: Network exploitable; Victim must voluntarily interact
with attack mechanism.

III. Impact

Buffer handling error leads to arbitrary code execution (CWE-119)

IV.  Workaround

None

V.   Solution

Update to package libmikmod-3.2.0-7.1 or later.

VI. References

http://bugs.meego.com/show_bug.cgi?id=2509
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-...
http://cwe.mitre.org/data/definitions/119.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)

iQEcBAEBAgAGBQJMNOVWAAoJECxjfBlj7RcKP6cIALhOLGkx0UrLElkNR7ckevLq
KpKnFLl7Q1/WWVSk88NCRVLbQhX6lF++gDVl4RhDp48HkoT8C9G3Jt2HQirg/V7F
3gYVfMVJVeCTtPs9966ewm/RpHD3q8WVZuVV8JvbFgF0kpwCP3x1rc7ZZa1oTnqO
nxNklUUNJgJLzFrEpmerbywlUwGntoO8nFJSa71uEt31It6vAOeZjbX5ChvD2/57
gn4hqRvllAq5w338fBk1eqAjzXnjoHDp1CGave15yT/ecGggzHZTK9gJtFIIapcI
6aXDaWjH22nbpsnZG8PPxazPQBwl+DUpgy3nqCEQbxTfXbHJdBWeGyIusqipXFA=
=sFaI
-----END PGP SIGNATURE-----

_______________________________________________
MeeGo-security mailing list
MeeGo-security@meego.com
http://lists.meego.com/listinfo/meego-security