[UNIX] XMMS Integer Overflow and Underflow Vulnerabilities
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 26 Mar 2007 14:25:22 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
XMMS Integer Overflow and Underflow Vulnerabilities
------------------------------------------------------------------------
SUMMARY
<http://www.xmms.org> XMMS is "a multimedia player for unix systems. XMMS
stands for X MultiMedia System and can play media files such as MP3,
MOD's, WAV and others with the use of Input plugins". Secunia Research has
discovered two vulnerabilities in XMMS, which can be exploited by
malicious people to compromise a user's system.
DETAILS
Vulnerable Systems:
* xmms version 1.2.10 (Linux)
1) An integer underflow error exists in the processing of skin bitmap
images. This can be exploited to cause a stack-based buffer overflow via
specially crafted skin images containing manipulated header information.
Successful exploitation allows execution of arbitrary code.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0653>
CVE-2007-0653
2) An integer overflow error exists in the processing of skin bitmap
images. This can be exploited to cause memory corruption via specially
crafted skin images containing manipulated header information.
Successful exploitation may allow the execution of arbitrary code.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0653>
CVE-2007-0653
Solution:
Do not install skins from untrusted sources.
Time Table:
06/02/2007 - Vendor notified (Red Hat and the vendor-sec list).
06/02/2007 - Vendor response.
21/03/2007 - Public disclosure.
ADDITIONAL INFORMATION
The information has been provided by Sven Krewitt, Secunia Research.
The original article can be found at:
<http://secunia.com/secunia_research/2007-47/>
http://secunia.com/secunia_research/2007-47/
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [UNIX] Evolution Shared Memo Categories Format String Vulnerability
- Next by Date: [UNIX] cftp Local Buffer Overflow Vulnerability
- Previous by thread: [UNIX] Evolution Shared Memo Categories Format String Vulnerability
- Next by thread: [UNIX] cftp Local Buffer Overflow Vulnerability
- Index(es):
Relevant Pages
- [UNIX] CMS Mundo SQL Injection and File Upload Vulnerabilities
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... CMS Mundo SQL Injection
and File Upload Vulnerabilities ... Successful exploitation requires access to the
administration section. ... (Securiteam) - [UNIX] Jetbox Multiple Vulnerabilities
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... a user's browser session
in context of an affected site. ... exploited to execute arbitrary HTML and script code
in a user's browser ... Successful exploitation may lead to execution of arbitrary PHP
code by ... (Securiteam) - [NT] Microsoft Internet Explorer ART File Heap Corruption
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Internet Explorer
ART File Heap Corruption ... Remote exploitation of a heap corruption vulnerability
in Microsoft ... (Securiteam) - [REVS] Analysis of the Exploitation Process
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... defines several of the common
types of vulnerabilities together with their ... seeking to gain a better understanding
of how these exploitation process ... (Securiteam) - [NEWS] Symantec Norton AntiVirus Multiple Local Privilege Escalation (MacOS)
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a
design error in the DiskMountNotify specifically ... "/Library/Application Support/Norton Solutions
Support/Norton ... Vendor Response: ... (Securiteam)
