libmikmod 3.1.11 through 3.2.0, as used by MikMod and possibly other products, allows user-assisted attackers to cause a denial of service (application crash) by loading an XM file.

The remote Solaris system is missing necessary patches to address security updates :

  - libmikmod 3.1.11 through 3.2.0, as used by MikMod and     possibly other products, allows user-assisted attackers     to cause a denial of service (application crash) by     loading an XM file. (CVE-2009-0179)

It was discovered that libMikMod incorrectly handled songs with different channel counts. If a user were tricked into opening a crafted song file, an attacker could cause a denial of service.
(CVE-2007-6720)

It was discovered that libMikMod incorrectly handled certain malformed XM files. If a user were tricked into opening a crafted XM file, an attacker could cause a denial of service. (CVE-2009-0179)

It was discovered that libMikMod incorrectly handled certain malformed Impulse Tracker files. If a user were tricked into opening a crafted Impulse Tracker file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3995, CVE-2010-2546, CVE-2010-2971)

It was discovered that libMikMod incorrectly handled certain malformed Ultratracker files. If a user were tricked into opening a crafted Ultratracker file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3996).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in libmikmod :

libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playback calculations, which allows user-assisted attackers to cause a denial of service (application crash) by loading multiple songs (aka MOD files) with different numbers of channels (CVE-2007-6720).

libmikmod 3.1.11 through 3.2.0, as used by MikMod and possibly other products, allows user-assisted attackers to cause a denial of service (application crash) by loading an XM file (CVE-2009-0179).

This update fixes these vulnerabilities.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Specially crafted XM files or playing mod files with varying number of channels could crash applications using libmikmod. (CVE-2009-0179 / CVE-2007-6720)

Specially crafted XM files or playing mod files with varying number of channels could crash applications using libmikmod. (CVE-2009-0179, CVE-2007-6720)

- Fri Aug 28 2009 Jindrich Novy <jnovy at redhat.com>     3.2.0-5.beta2

    - fix CVE-2007-6720 (#479829)

    - fix CVE-2009-0179 (#479833)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Aug 28 2009 Jindrich Novy <jnovy at redhat.com>     3.2.0-4.beta2

    - fix CVE-2007-6720 (#479829)

    - fix CVE-2009-0179 (#479833)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted XM files or playing mod files with varying number of channels could crash applications using libmikmod (CVE-2009-0179, CVE-2007-6720).

ID	Name	Product	Family	Severity
80672	Oracle Solaris Third-Party Patch Update : libmikmod (cve_2009_0179_denial_of)	Nessus	Solaris Local Security Checks	medium
49764	Ubuntu 8.04 LTS / 9.04 / 9.10 : libmikmod vulnerabilities (USN-995-1)	Nessus	Ubuntu Local Security Checks	high
42097	Mandriva Linux Security Advisory : libmikmod (MDVSA-2009:272-1)	Nessus	Mandriva Local Security Checks	medium
41545	SuSE 10 Security Update : libmikmod (ZYPP Patch Number 6034)	Nessus	SuSE Local Security Checks	medium
41282	SuSE9 Security Update : libmikmod (YOU Patch Number 12359)	Nessus	SuSE Local Security Checks	medium
40810	Fedora 11 : libmikmod-3.2.0-5.beta2.fc11 (2009-9112)	Nessus	Fedora Local Security Checks	medium
40809	Fedora 10 : libmikmod-3.2.0-4.beta2.fc10 (2009-9095)	Nessus	Fedora Local Security Checks	medium
40257	openSUSE Security Update : libmikmod (libmikmod-570)	Nessus	SuSE Local Security Checks	medium
40025	openSUSE Security Update : libmikmod (libmikmod-570)	Nessus	SuSE Local Security Checks	medium
35759	openSUSE 10 Security Update : libmikmod (libmikmod-6033)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2009-0179

high

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium