OpenMPT Multiple Remote Code Execution Vulnerabilities
BID:19448
CVE-2006-4192 |Info
OpenMPT Multiple Remote Code Execution Vulnerabilities
| Bugtraq ID: | 19448 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2006-4192 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 09 2006 12:00AM |
| Updated: | Mar 19 2015 08:38AM |
| Credit: | Luigi Auriemma discovered these issues. |
| Vulnerable: |
Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise Server SDK 9 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 10 SuSE SUSE Linux Enterprise Desktop 10 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Open-Enterprise-Server 1 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Office Server S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Openexchange Server S.u.S.E. Linux Office Server S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Desktop 1.0 S.u.S.E. Linux Desktop 10 S.u.S.E. Linux Database Server 0 S.u.S.E. Linux Connectivity Server RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop version 4 Red Hat Enterprise Linux AS 4 OpenMPT OpenMPT SVN 157 OpenMPT OpenMPT SVN 156 OpenMPT OpenMPT 1.17.02.43 OpenMPT OpenMPT 1.17.02.42 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 libmodplug libmodplug 0.8 Gentoo Linux |
| Not Vulnerable: |
libmodplug libmodplug 0.8.4 |
Discussion
OpenMPT Multiple Remote Code Execution Vulnerabilities
OpenMPT is prone to multiple remote code-execution vulnerabilities because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.
Exploiting these issues allows remote attackers to execute arbitrary machine code in the context of affected servers. This facilitates the remote compromise of affected computers.
These versions are affected:
1.17.02.43 and earlier
SVN versions 157 and earlier.
OpenMPT is prone to multiple remote code-execution vulnerabilities because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.
Exploiting these issues allows remote attackers to execute arbitrary machine code in the context of affected servers. This facilitates the remote compromise of affected computers.
These versions are affected:
1.17.02.43 and earlier
SVN versions 157 and earlier.
Exploit / POC
OpenMPT Multiple Remote Code Execution Vulnerabilities
Sample exploit code has been provided:
Sample exploit code has been provided:
Solution / Fix
OpenMPT Multiple Remote Code Execution Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Mandriva Linux Mandrake 2007.0
libmodplug libmodplug 0.8
Mandriva Linux Mandrake 2007.0 x86_64
Solution:
Updates are available. Please see the references for more information.
Mandriva Linux Mandrake 2007.0
-
Mandriva libmodplug-0.7-7.1mdv2007.0.src.rpm
Mandriva Linux 2007.0:
http://www.mandriva.com/en/download -
Mandriva libmodplug0-0.7-7.1mdv2007.0.i586.rpm
Mandriva Linux 2007.0:
http://www.mandriva.com/en/download -
Mandriva libmodplug0-devel-0.7-7.1mdv2007.0.i586.rpm
Mandriva Linux 2007.0:
http://www.mandriva.com/en/download
libmodplug libmodplug 0.8
-
libmodplug libmodplug 0.8.4
http://sourceforge.net/project/showfiles.php?group_id=1275&package_id= 184252&release_id=460319
Mandriva Linux Mandrake 2007.0 x86_64
-
Mandriva lib64modplug0-0.7-7.1mdv2007.0.x86_64.rpm
Mandriva Linux 2007.0/X86_64:
http://www.mandriva.com/en/download -
Mandriva lib64modplug0-devel-0.7-7.1mdv2007.0.x86_64.rpm
Mandriva Linux 2007.0/X86_64:
http://www.mandriva.com/en/download -
Mandriva libmodplug-0.7-7.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
http://www.mandriva.com/en/download
References
OpenMPT Multiple Remote Code Execution Vulnerabilities
References:
References:
- OpenMPT (aka Modplug Tracker) (Luigi Auriemma)
- OpenMPT (aka Modplug Tracker) Web Site (OpenMPT (aka Modplug Tracker))
- Release Name: 0.8.4 (libmodplug)
- [Full-disclosure] Stack and heap overflows in MODPlug Tracker/OpenMPT 1.17.02.43 (Luigi Auriemma