ABCPP Directive Handler Buffer Overflow Vulnerability

Bugtraq ID:	12021
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 15 2004 12:00AM
Updated:	Dec 15 2004 12:00AM
Credit:	Discovery is credited to Yosef Klein.
Vulnerable:	abcpp abcpp 1.3 .0
Not Vulnerable:

ABCPP Directive Handler Buffer Overflow Vulnerability

abcpp is prone to a buffer overflow vulnerability. This issue is exposed when the program is used to handle directives in ABC music notation files. Since the ABC files may originate from an external or untrusted source, this issue is considered remote in nature.

Successful exploitation will result in execution of arbitrary code in the context of the user running the application.

ABCPP Directive Handler Buffer Overflow Vulnerability

The following exploit example has been published:

• /data/vulnerabilities/exploits/80.abc.zip

ABCPP Directive Handler Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ABCPP Directive Handler Buffer Overflow Vulnerability

References:

• [remote] [control] abcpp 1.3.0 process_directive overflows token buffer ("D. J. Bernstein" )
  
• abcpp Homepage (abcpp)