Buffer overflow in mikmod 3.1.6 and earlier allows remote attackers to execute arbitrary code via an archive file that contains a file with a long filename.

Updated mikmod packages that fix a security issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

MikMod is a well known MOD music file player for UNIX-based systems.

A buffer overflow bug was found in mikmod during the processing of archive filenames. An attacker could create a malicious archive that when opened by mikmod could result in arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0427 to this issue.

Users of mikmod are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:506 advisory.

    MikMod is a well known MOD music file player for UNIX-based systems.

    A buffer overflow bug was found in mikmod during the processing of archive     filenames. An attacker could create a malicious archive that when opened by     mikmod could result in arbitrary code execution. The Common Vulnerabilities     and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0427     to this issue.

    Users of mikmod are advised to upgrade to these erratum packages, which     contain backported security patches and are not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.

ID	Name	Product	Family	Severity
21835	CentOS 3 / 4 : mikmod (CESA-2005:506)	Nessus	CentOS Local Security Checks	high
18476	RHEL 4 : mikmod (RHSA-2005:506)	Nessus	Red Hat Local Security Checks	critical
15157	Debian DSA-320-1 : mikmod - buffer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2003-0427

critical

Tenable Plugins

high

critical

high