FreeBSD : alsaplayer -- multiple vulnerabilities (9855ac8e-2aec-11db-a6e2-000e0c2e438a)

medium Nessus Plugin ID 56494

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Luigi Auriemma reports three vulnerabilities within alsaplayer :

- The function which handles the HTTP connections is vulnerable to a buffer-overflow that happens when it uses sscanf for copying the URL in the Location's field received from the server into the redirect buffer of only 1024 bytes declared in http_open.

- A buffer-overflow exists in the functions which add items to the playlist when the GTK interface is used (so the other interfaces are not affected by this problem): new_list_item and CbUpdated in interface/gtk/PlaylistWindow.cpp.

- AlsaPlayer automatically queries the CDDB server specified in its configuration (by default freedb.freedb.org) when the user choices the CDDA function for playing audio CDs. The function which queries the server uses a buffer of 20 bytes and one of 9 for storing the category and ID strings received from the server while the buffer which contains this server's response is 32768 bytes long. Naturally for exploiting this bug the attacker must have control of the freedb server specified in the AlsaPlayer's configuration.

These vulnerabilities could allow a remote attacker to execute arbitrary code, possibly gaining access to the system.

Solution

Update the affected package.

Plugin Details

Severity: Medium

ID: 56494

File Name: freebsd_pkg_9855ac8e2aec11dba6e2000e0c2e438a.nasl

Version: 1.5

Type: local

Family: FreeBSD Local Security Checks

Published: 10/14/2011

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:alsaplayer, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/13/2006

Vulnerability Publication Date: 8/9/2006

Reference Information

CVE: CVE-2006-4089

BID: 19450

Detections

Analytics