libmodplug: CVE-2006-4192: buffer/heap overflow -> arbitrary code execution as user

Debian Bug report logs - #383574
libmodplug: CVE-2006-4192: buffer/heap overflow -> arbitrary code execution as user

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Alec Berryman <alec@thened.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libmodplug: CVE-2006-4192: buffer/heap overflow -> arbitrary code execution as user

Date: Thu, 17 Aug 2006 23:38:07 -0400

Package: libmodplug
Version: 1:0.7-4 1:0.7-5
Severity: grave
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2006-4192: "Multiple buffer overflows in MODPlug Tracker (OpenMPT)
1.17.02.43 and earlier and libmodplug 0.8 and earlier allow
user-assisted remote attackers to execute arbitrary code via (1) long
strings in ITP files used by the CSoundFile::ReadITProject function in
soundlib/Load_it.cpp and (2) crafted modules used by the
CSoundFile::ReadSample function in soundlib/Sndfile.cpp, as demonstrated
by crafted AMF files."

I have confirmed the second vector but have not confirmed the first.
The original advisory [1] includes proof-of-concept code [2] to generate
sample ITP and AMF files; cmus (using libmodplug) crashed while playing
the AMF file.

The advisory says that a fixed version is forthcoming; the website [3]
has an update from 2006-08-10 saying that 0.8.2 is "soon to be
released", but does not mention this issue.

I have not confirmed that this issue affects sarge, but the changelog
between the version in sarge and the version in etch only mentions a
transition rebuild; I fully expect sarge is vulnerable.

Please don't forget to mention the CVE in your changelog.

Thanks,

Alec

[1] http://aluigi.altervista.org/adv/mptho-adv.txt
[2] http://aluigi.org/poc/mptho.zip

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFE5TYfAud/2YgchcQRAvoUAJ0R5Pixj6yVxy+xt0Qql6aGzO7Z7wCgvL7L
uwaIPwr9cF0KluGrSyji9JQ=
=Qi9t
-----END PGP SIGNATURE-----

Message #10 received at 383574@bugs.debian.org (full text, mbox, reply):

From: "Steinar H. Gunderson" <sgunderson@bigfoot.com>

To: Alec Berryman <alec@thened.net>

Cc: 383574@bugs.debian.org, control@bugs.debian.org

Subject: Re: libmodplug: CVE-2006-4192: buffer/heap overflow -> arbitrary code execution as user

Date: Mon, 25 Sep 2006 17:48:26 +0200

clone 383574 -1
reassign -1 cmus
retitle -1 CVE-2006-4192: cmus needs to be rebuilt against libmodplug >= 0.7-5.2 to fix arbitrary code execution
thanks

On Thu, Aug 17, 2006 at 11:38:07PM -0400, Alec Berryman wrote:
> I have confirmed the second vector but have not confirmed the first.

The first only applies to modplug, not libmodplug (since libmodplug doesn't
support the ITP format, according to the advisory), so it's irrelevant for
Debian TTBOMK.

The second seems to be easily fixed (just check for "< 4" signed instead of
unsigned); I'm preparing an NMU now, and I'm quite sure the fix will apply
cleanly to sarge.

> The original advisory [1] includes proof-of-concept code [2] to generate
> sample ITP and AMF files; cmus (using libmodplug) crashed while playing
> the AMF file.

Note that cmus links statically to libmodplug for some reason, so it will
have to be relinked. I haven't tested it, but at least my patch fixes the
issue for xmms-modplug.

/* Steinar */
-- 
Homepage: http://www.sesse.net/

Message #19 received at 383574-done@bugs.debian.org (full text, mbox, reply):

From: "Steinar H. Gunderson" <sesse@debian.org>

To: 383574-done@bugs.debian.org

Subject: Re: Fixed in NMU of libmodplug 1:0.7-5.2

Date: Mon, 25 Sep 2006 18:06:49 +0200

Version: 1:0.7-5.2

I've NMUed for this bug (fixing the bug to use versioning instead of the
"fixed" tag, to ease tracking through testing); here's the changelog:

>  libmodplug (1:0.7-5.2) unstable; urgency=medium
>  .
>    * Non-maintainer upload.
>    * Check for very large sample sizes that could create overflows, enabling an
>      attacker to allocate zero bytes and possibly execute arbitrary codes as
>      the user [CVE-2006-4192]. (Closes: #383574)
>    * Run aclocal-1.9 instead of aclocal, as automake1.9 doesn't provide the
>      latter; fixes FTBFS.

/* Steinar */
-- 
Homepage: http://www.sesse.net/

Send a report that this bug log contains spam.