Published: 18/07/2006 Updated: 20/07/2017

CVSS v2 Base Score: 7.6 | Impact Score: 10 | Exploitability Score: 4.9

VMScore: 765

Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C

Subscribe to Dynamic Universal Music Bibliotheque

Heap-based buffer overflow in the it_read_envelope function in Dynamic Universal Music Bibliotheque (DUMB) 0.9.3 and previous versions and current CVS as of 20060716, including libdumb, allows user-assisted malicious users to execute arbitrary code via a ".it" (Impulse Tracker) file with an envelope with a large number of nodes.

Vulnerable Product	Search on Vulmon	Subscribe to Product
dynamic universal music bibliotheque dumb

Debian Bug report logs - #379064 dumb: CVE-2006-3668: arbitrary code execution Package: libdumb; Maintainer for libdumb is Debian Games Team <pkg-games-devel@listsaliothdebianorg>; Reported by: Alec Berryman <alec@thenednet> Date: Thu, 20 Jul 2006 22:48:06 UTC Severity: serious Tags: security Fixed in versions l ...

Luigi Auriemma discovered that DUMB, a tracker music library, performs insufficient sanitising of values parsed from IT music files, which might lead to a buffer overflow and execution of arbitrary code if manipulated files are read For the stable distribution (sarge) this problem has been fixed in version 092-6 For the unstable distribution (s ...

/* by Luigi Auriemma */ #include <stdioh> #include <stdlibh> #include <stringh> #include <stdinth> #define VER "01" #define BOF 255 // 25 < BOF < 256 #define INSTRSZ 371 #define POCNAME "proof-of-concept" void fwi08(FILE *fd, int num); void fwi16(FILE *fd, int num); void fwi32( ...

CWE-119 http://aluigi.altervista.org/adv/dumbit-adv.txt http://secunia.com/advisories/21092 http://www.securityfocus.com/bid/19025 http://www.debian.org/security/2006/dsa-1123 http://secunia.com/advisories/21184 http://www.gentoo.org/security/en/glsa/glsa-200608-14.xml http://secunia.com/advisories/21416 http://securityreason.com/securityalert/1240 http://www.vupen.com/english/advisories/2006/2835 https://exchange.xforce.ibmcloud.com/vulnerabilities/27789 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=379064 https://nvd.nist.gov https://www.exploit-db.com/exploits/2037/https://www.debian.org/security/./dsa-1123

CVE-2006-3668

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect