Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43 and earlier and libmodplug 0.8 and earlier, as used in GStreamer and possibly other products, allow user-assisted remote attackers to execute arbitrary code via (1) long strings in ITP files used by the CSoundFile::ReadITProject function in soundlib/Load_it.cpp and (2) crafted modules used by the CSoundFile::ReadSample function in soundlib/Sndfile.cpp, as demonstrated by crafted AMF files.

From Red Hat Security Advisory 2011:0477 :

Updated gstreamer-plugins packages that fix two security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The gstreamer-plugins packages contain plug-ins used by the GStreamer streaming-media framework to support a wide variety of media formats.

An integer overflow flaw, leading to a heap-based buffer overflow, and a stack-based buffer overflow flaw were found in various ModPlug music file format library (libmodplug) modules, embedded in GStreamer. An attacker could create specially crafted music files that, when played by a victim, would cause applications using GStreamer to crash or, potentially, execute arbitrary code. (CVE-2006-4192, CVE-2011-1574)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing the update, all applications using GStreamer (such as Rhythmbox) must be restarted for the changes to take effect.

An integer overflow flaw, leading to a heap-based buffer overflow, and a stack-based buffer overflow flaw were found in various ModPlug music file format library (libmodplug) modules, embedded in GStreamer. An attacker could create specially crafted music files that, when played by a victim, would cause applications using GStreamer to crash or, potentially, execute arbitrary code. (CVE-2006-4192, CVE-2011-1574)

All applications using GStreamer (such as Rhythmbox) must be restarted for the changes to take effect.

Updated gstreamer-plugins packages that fix two security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The gstreamer-plugins packages contain plug-ins used by the GStreamer streaming-media framework to support a wide variety of media formats.

An integer overflow flaw, leading to a heap-based buffer overflow, and a stack-based buffer overflow flaw were found in various ModPlug music file format library (libmodplug) modules, embedded in GStreamer. An attacker could create specially crafted music files that, when played by a victim, would cause applications using GStreamer to crash or, potentially, execute arbitrary code. (CVE-2006-4192, CVE-2011-1574)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing the update, all applications using GStreamer (such as Rhythmbox) must be restarted for the changes to take effect.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0477 advisory.

  - libmodplug: Integer overflow when reading samples of AMF files (CVE-2006-4192)

  - libmodplug: ReadS3M stack overflow vulnerability (CVE-2011-1574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Luigi Auriemma discovered that libmodplug did not properly sanitize its input. A specially crafted AMF file could be used to exploit this situation to cause buffer overflows and possibly execute arbitrary code as the user.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted AMF files could potentially be used to exploit a heap based buffer overflow in libmodplug (CVE-2006-4192).

Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43 and earlier and libmodplug 0.8 and earlier allow user-assisted remote attackers to execute arbitrary code via (1) long strings in ITP files used by the CSoundFile::ReadITProject function in soundlib/Load_it.cpp and (2) crafted modules used by the CSoundFile::ReadSample function in soundlib/Sndfile.cpp, as demonstrated by crafted AMF files.

Updated packages are patched to address this issue.

The remote host is affected by the vulnerability described in GLSA-200612-04 (ModPlug: Multiple buffer overflows)

    Luigi Auriemma has reported various boundary errors in load_it.cpp and     a boundary error in the 'CSoundFile::ReadSample()' function in     sndfile.cpp.
  Impact :

    A remote attacker can entice a user to read crafted modules or ITP     files, which may trigger a buffer overflow resulting in the execution     of arbitrary code with the privileges of the user running the     application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
68266	Oracle Linux 4 : gstreamer-plugins (ELSA-2011-0477)	Nessus	Oracle Linux Local Security Checks	medium
61030	Scientific Linux Security Update : gstreamer-plugins on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
53642	CentOS 4 : gstreamer-plugins (CESA-2011:0477)	Nessus	CentOS Local Security Checks	medium
53630	RHEL 4 : gstreamer-plugins (RHSA-2011:0477)	Nessus	Red Hat Local Security Checks	high
28126	Ubuntu 6.06 LTS / 6.10 : libmodplug vulnerability (USN-521-1)	Nessus	Ubuntu Local Security Checks	medium
27491	openSUSE 10 Security Update : xmms-plugins (xmms-plugins-2101)	Nessus	SuSE Local Security Checks	medium
24618	Mandrake Linux Security Advisory : libmodplug (MDKSA-2007:001)	Nessus	Mandriva Local Security Checks	medium
23856	GLSA-200612-04 : ModPlug: Multiple buffer overflows	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2006-4192

high

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium