FreeBSD : alsaplayer -- multiple vulnerabilities (9855ac8e-2aec-11db-a6e2-000e0c2e438a)

Medium Nessus Plugin ID 56494


The remote FreeBSD host is missing a security-related update.


Luigi Auriemma reports three vulnerabilities within alsaplayer :

- The function which handles the HTTP connections is vulnerable to a buffer-overflow that happens when it uses sscanf for copying the URL in the Location's field received from the server into the redirect buffer of only 1024 bytes declared in http_open.

- A buffer-overflow exists in the functions which add items to the playlist when the GTK interface is used (so the other interfaces are not affected by this problem): new_list_item and CbUpdated in interface/gtk/PlaylistWindow.cpp.

- AlsaPlayer automatically queries the CDDB server specified in its configuration (by default when the user choices the CDDA function for playing audio CDs. The function which queries the server uses a buffer of 20 bytes and one of 9 for storing the category and ID strings received from the server while the buffer which contains this server's response is 32768 bytes long. Naturally for exploiting this bug the attacker must have control of the freedb server specified in the AlsaPlayer's configuration.

These vulnerabilities could allow a remote attacker to execute arbitrary code, possibly gaining access to the system.


Update the affected package.

See Also

Plugin Details

Severity: Medium

ID: 56494

File Name: freebsd_pkg_9855ac8e2aec11dba6e2000e0c2e438a.nasl

Version: $Revision: 1.3 $

Type: local

Published: 2011/10/14

Modified: 2013/06/22

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:F/RL:U/RC:ND

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:alsaplayer, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2006/08/13

Vulnerability Publication Date: 2006/08/09

Reference Information

CVE: CVE-2006-4089

BID: 19450