Several vulnerabilities that can lead to the execution of arbitrary code have been discovered in libmodplug, a library for MOD music based on ModPlug. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2011-1761     epiphant discovered that the abc file parser is     vulnerable to several stack-based buffer overflows that     potentially lead to the execution of arbitrary code.

  - CVE-2011-2911     Hossein Lotfi of Secunia discovered that the     CSoundFile::ReadWav function is vulnerable to an integer     overflow which leads to a heap-based buffer overflow. An     attacker can exploit this flaw to potentially execute     arbitrary code by tricking a victim into opening crafted     WAV files.

  - CVE-2011-2912     Hossein Lotfi of Secunia discovered that the     CSoundFile::ReadS3M function is vulnerable to a     stack-based buffer overflow. An attacker can exploit     this flaw to potentially execute arbitrary code by     tricking a victim into opening crafted S3M files.

  - CVE-2011-2913     Hossein Lotfi of Secunia discovered that the     CSoundFile::ReadAMS function suffers from an off-by-one     vulnerability that leads to memory corruption. An     attacker can exploit this flaw to potentially execute     arbitrary code by tricking a victim into opening crafted     AMS files.

  - CVE-2011-2914     It was discovered that the CSoundFile::ReadDSM function     suffers from an off-by-one vulnerability that leads to     memory corruption. An attacker can exploit this flaw to     potentially execute arbitrary code by tricking a victim     into opening crafted DSM files.

  - CVE-2011-2915     It was discovered that the CSoundFile::ReadAMS2 function     suffers from an off-by-one vulnerability that leads to     memory corruption. An attacker can exploit this flaw to     potentially execute arbitrary code by tricking a victim     into opening crafted AMS files.

The remote host is affected by the vulnerability described in GLSA-201203-14 (Audacious Plugins: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been found in Audacious Plugins:
      The 'CSoundFile::ReadWav()' function in load_wav.cpp contains an         integer overflow which could cause a heap-based buffer overflow         (CVE-2011-2911).
      The 'CSoundFile::ReadS3M()' function in load_s3m.cpp contains         multiple boundary errors which could cause a stack-based buffer         overflow (CVE-2011-2912).
      The 'CSoundFile::ReadAMS()' function in load_ams.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2913).
      The 'CSoundFile::ReadDSM()' function in load_dms.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2914).
      The 'CSoundFile::ReadAMS2()' function in load_ams.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2915).
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file, possibly resulting in execution of arbitrary code, or a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2011:1264 :

Updated gstreamer-plugins packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The gstreamer-plugins packages contain plug-ins used by the GStreamer streaming-media framework to support a wide variety of media formats.

An integer overflow flaw, a boundary error, and multiple off-by-one flaws were found in various ModPlug music file format library (libmodplug) modules, embedded in GStreamer. An attacker could create specially crafted music files that, when played by a victim, would cause applications using GStreamer to crash or, potentially, execute arbitrary code. (CVE-2011-2911, CVE-2011-2912, CVE-2011-2913, CVE-2011-2914, CVE-2011-2915)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing the update, all applications using GStreamer (such as Rhythmbox) must be restarted for the changes to take effect.

This update of libmodplug0 fixes the following issues :

1) An integer overflow error exists within the 'CSoundFile::ReadWav()' function (src/load_wav.cpp) when processing certain WAV files. This can be exploited to cause a heap-based buffer overflow by tricking a user into opening a specially crafted WAV file. (CVE-2011-2911)

2) Boundary errors within the 'CSoundFile::ReadS3M()' function (src/load_s3m.cpp) when processing S3M files can be exploited to cause stack-based buffer overflows by tricking a user into opening a specially crafted S3M file. (CVE-2011-2912)

3) An off-by-one error within the 'CSoundFile::ReadAMS()' function (src/load_ams.cpp) can be exploited to cause a stack corruption by tricking a user into opening a specially crafted AMS file.
(CVE-2011-2913)

4) An off-by-one error within the 'CSoundFile::ReadDSM()' function (src/load_dms.cpp) can be exploited to cause a memory corruption by tricking a user into opening a specially crafted DSM file.
(CVE-2011-2914)

5) An off-by-one error within the 'CSoundFile::ReadAMS2()' function (src/load_ams.cpp) can be exploited to cause a memory corruption by tricking a user into opening a specially crafted AMS file.
(CVE-2011-2915)

Also an overflow in the ABC loader was fixed. (CVE-2011-1761)

Update to upstream version 0.8.8.4.

http://modplug-xmms.sourceforge.net/#news http://secunia.com/advisories/45131

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The gstreamer-plugins packages contain plug-ins used by the GStreamer streaming-media framework to support a wide variety of media formats.

An integer overflow flaw, a boundary error, and multiple off-by-one flaws were found in various ModPlug music file format library (libmodplug) modules, embedded in GStreamer. An attacker could create specially crafted music files that, when played by a victim, would cause applications using GStreamer to crash or, potentially, execute arbitrary code. (CVE-2011-2911, CVE-2011-2912, CVE-2011-2913, CVE-2011-2914, CVE-2011-2915)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing the update, all applications using GStreamer (such as Rhythmbox) must be restarted for the changes to take effect.

ID	名稱	產品	系列	已發布	已更新	嚴重性
58078	Debian DSA-2415-1 : libmodplug - several vulnerabilities	Nessus	Debian Local Security Checks	2012/2/22	2021/1/11	medium
58379	GLSA-201203-14 : Audacious Plugins: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	2012/3/19	2021/1/6	medium
68345	Oracle Linux 4 : gstreamer-plugins (ELSA-2011-1264)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
75902	openSUSE Security Update : libmodplug (openSUSE-SU-2011:0943-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
55870	Fedora 15 : libmodplug-0.8.8.4-1.fc15 (2011-10544)	Nessus	Fedora Local Security Checks	2011/8/17	2021/1/11	medium
61131	Scientific Linux Security Update : gstreamer-plugins on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium