Cheese Tracker XM Loader Buffer Overflow Vulnerability

Bugtraq ID:	19115
Class:	Boundary Condition Error
CVE:	CVE-2006-3814
Remote:	Yes
Local:	No
Published:	Jul 23 2006 12:00AM
Updated:	Dec 22 2006 12:03AM
Credit:	Luigi Auriemma discovered this issue.
Vulnerable:	Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Cheese Tracker Cheese Tracker 0.9.9
Not Vulnerable:

Cheese Tracker XM Loader Buffer Overflow Vulnerability

Cheese Tracker is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input data before copying it to an insufficiently sized memory buffer.

An attacker may cause malicious code to execute by supplying a malicious XM file. This may facilitate unauthorized remote access with the privileges of the user running the vulnerable application.

Cheese Tracker XM Loader Buffer Overflow Vulnerability

Exploit code is available.

• /data/vulnerabilities/exploits/cheesetracker_exp.c

Cheese Tracker XM Loader Buffer Overflow Vulnerability

Solution:
Please see the references for more information and vendor advisories.


Cheese Tracker Cheese Tracker 0.9.9

• Debian cheesetracker_0.9.9-1sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_alpha.deb


• Debian cheesetracker_0.9.9-1sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_amd64.deb


• Debian cheesetracker_0.9.9-1sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_arm.deb


• Debian cheesetracker_0.9.9-1sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_hppa.deb


• Debian cheesetracker_0.9.9-1sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_i386.deb


• Debian cheesetracker_0.9.9-1sarge1_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_ia64.deb


• Debian cheesetracker_0.9.9-1sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_m68k.deb


• Debian cheesetracker_0.9.9-1sarge1_mips.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_mips.deb


• Debian cheesetracker_0.9.9-1sarge1_mipsel.deb
  Debian 3.1 (stable)
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_mipsel.deb


• Debian cheesetracker_0.9.9-1sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_powerpc.deb


• Debian cheesetracker_0.9.9-1sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_s390.deb


• Debian cheesetracker_0.9.9-1sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/cheesetracker/cheesetra cker_0.9.9-1sarge1_sparc.deb

Cheese Tracker XM Loader Buffer Overflow Vulnerability

References:

• Cheese Tracker (Cheese Tracker)
  
• Buffer-overflow in the XM loader of Cheese Tracker 0.9.9 (Luigi Auriemma )