Open Cubic Player Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	19262
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 31 2006 12:00AM
Updated:	Aug 01 2006 07:26PM
Credit:	Luigi Auriemma is credited with discovering these vulnerabilities.
Vulnerable:	Open Cubic Player Open Cubic Player 2.6 Open Cubic Player Open Cubic Player 0.1.10 rc5
Not Vulnerable:

Open Cubic Player Multiple Buffer Overflow Vulnerabilities

Open Cubic Player is affected by multiple remote buffer-overflow vulnerabilities because the application fails to properly bounds-check user-supplied input before copying it into insufficiently sized memory buffers.

These issues allow remote attackers to execute arbitrary machine code in the context of the user running the application.

Open Cubic Player Multiple Buffer Overflow Vulnerabilities

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/cubic-jul31-2006.c

Open Cubic Player Multiple Buffer Overflow Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Open Cubic Player Multiple Buffer Overflow Vulnerabilities

References:

• Open Cubic Player Homepage (Open Cubic Player)
  
• Multiple vulnerabilities in Open Cubic Player 2.6.0pre6 /0.1.10_rc5 ( Luigi Auriemma)