Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via an Ultratracker file.

From Red Hat Security Advisory 2010:0720 :

Updated mikmod packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MikMod is a MOD music file player for Linux, UNIX, and similar operating systems. It supports various file formats including MOD, STM, S3M, MTM, XM, ULT, and IT.

Multiple input validation flaws, resulting in buffer overflows, were discovered in MikMod. Specially crafted music files in various formats could, when played, cause an application using the MikMod library to crash or, potentially, execute arbitrary code. (CVE-2009-3995, CVE-2009-3996, CVE-2007-6720)

All MikMod users should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using the MikMod library must be restarted for this update to take effect.

Multiple input validation flaws, resulting in buffer overflows, were discovered in MikMod. Specially crafted music files in various formats could, when played, cause an application using the MikMod library to crash or, potentially, execute arbitrary code. (CVE-2009-3995, CVE-2009-3996, CVE-2007-6720)

All running applications using the MikMod library must be restarted for this update to take effect.

Specially crafted 'Impulse Tracker' and 'Ultratracker' files could cause a heap based buffer overflow in libmikmod. Attackers could exploit that to crash or potentially execute code in applications linking against libmikmod. (CVE-2009-3995 / CVE-2009-3996)

It was discovered that libMikMod incorrectly handled songs with different channel counts. If a user were tricked into opening a crafted song file, an attacker could cause a denial of service.
(CVE-2007-6720)

It was discovered that libMikMod incorrectly handled certain malformed XM files. If a user were tricked into opening a crafted XM file, an attacker could cause a denial of service. (CVE-2009-0179)

It was discovered that libMikMod incorrectly handled certain malformed Impulse Tracker files. If a user were tricked into opening a crafted Impulse Tracker file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3995, CVE-2010-2546, CVE-2010-2971)

It was discovered that libMikMod incorrectly handled certain malformed Ultratracker files. If a user were tricked into opening a crafted Ultratracker file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3996).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated mikmod packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

MikMod is a MOD music file player for Linux, UNIX, and similar operating systems. It supports various file formats including MOD, STM, S3M, MTM, XM, ULT, and IT.

Multiple input validation flaws, resulting in buffer overflows, were discovered in MikMod. Specially crafted music files in various formats could, when played, cause an application using the MikMod library to crash or, potentially, execute arbitrary code. (CVE-2009-3995, CVE-2009-3996, CVE-2007-6720)

All MikMod users should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using the MikMod library must be restarted for this update to take effect.

Fixes CVE-2009-3995 and CVE-2009-3996.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2009-3995 and CVE-2009-3996

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in libmikmod :

Multiple heap-based buffer overflows might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file (CVE-2009-3995).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

Dyon Balding discovered buffer overflows in the MikMod sound library, which could lead to the execution of arbitrary code if a user is tricked into opening malformed Impulse Tracker or Ultratracker sound files.

Specially crafted 'Impulse Tracker' and 'Ultratracker' files could cause a heap based buffer overflow in libmikmod. Attackers could exploit that to crash or potentially execute code in applications linking against libmikmod (CVE-2009-3995, CVE-2009-3996).

The remote host is running Winamp, a media player for Windows.  The version of Winamp installed on the remote host is earlier than 5.57.  Such versions are potentially affected by multiple vulnerabilities : 

  - A boundary error in the Module Decoder Plug-in exists when parsing samples and can be exploited to cause a heap-based buffer overflow via a specially crafted 'Impulse Tracker' file. (CVE-2009-3995)

  - An error in the Module Decoder Plug-in when parsing 'Ultratracker' files can be exploited to cause a heap-based buffer overflow. (CVE-2009-3996)

  - An integer overflow error exists in the Module Decoder Plug-in when parsing 'Oktalyzer' files and can be exploited to cause a heap-based buffer overflow.

  - Multiple integer overflow vulnerabilities in the 'jpeg.w5s' and 'png.w5s' filters when processing malformed 'JPEG' and 'PNG' data.

The remote host is running Winamp, a media player for Windows.

The version of Winamp installed on the remote host is earlier than 5.57.  Such versions are potentially affected by multiple issues :

  - A boundary error in the Module Decoder Plug-in exists     when parsing samples and can be exploited to cause a     heap-based buffer overflow. (CVE-2009-3995)

  - An error in the Module Decoder Plug-in when parsing     'Ultratracker' fields and can be exploited to cause a     heap-based buffer overflow. (CVE-2009-3996)

  - An integer overflow error in the Module Decoder Plug-in     when parsing 'Oktalyzer' files and can be exploited to     cause a heap-based buffer overflow. (CVE-2009-3997)     
  - Integer overflow errors within the 'jpeg.w5s' and     'png.w5s' filters when processing malformed 'JPEG' or     'PNG' data in a media file. (CVE-2009-4356)

ID	Name	Product	Family	Severity
68105	Oracle Linux 3 / 4 / 5 : mikmod (ELSA-2010-0720)	Nessus	Oracle Linux Local Security Checks	high
60860	Scientific Linux Security Update : mikmod on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
50934	SuSE 11 Security Update : libmikmod (SAT Patch Number 2354)	Nessus	SuSE Local Security Checks	high
49879	SuSE 10 Security Update : libmikmod (ZYPP Patch Number 7004)	Nessus	SuSE Local Security Checks	high
49764	Ubuntu 8.04 LTS / 9.04 / 9.10 : libmikmod vulnerabilities (USN-995-1)	Nessus	Ubuntu Local Security Checks	high
49745	RHEL 3 / 4 / 5 : mikmod (RHSA-2010:0720)	Nessus	Red Hat Local Security Checks	high
49714	CentOS 3 / 4 / 5 : mikmod (CESA-2010:0720)	Nessus	CentOS Local Security Checks	high
49157	Fedora 13 : libmikmod-3.2.0-11.beta2.fc13 (2010-13702)	Nessus	Fedora Local Security Checks	high
49122	Fedora 14 : libmikmod-3.2.0-11.beta2.fc14 (2010-13673)	Nessus	Fedora Local Security Checks	high
48345	Mandriva Linux Security Advisory : libmikmod (MDVSA-2010:151)	Nessus	Mandriva Local Security Checks	high
47736	Debian DSA-2071-1 : libmikmod - buffer overflows	Nessus	Debian Local Security Checks	high
46234	openSUSE Security Update : libmikmod (openSUSE-SU-2010:0209-1)	Nessus	SuSE Local Security Checks	high
46231	openSUSE Security Update : libmikmod (openSUSE-SU-2010:0209-1)	Nessus	SuSE Local Security Checks	high
46228	openSUSE Security Update : libmikmod (openSUSE-SU-2010:0209-1)	Nessus	SuSE Local Security Checks	high
5267	Winamp < 5.57 Multiple Vulnerabilities	Nessus Network Monitor	Generic	medium
43181	Winamp < 5.57 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2009-3996

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high