id3lib ID3 Tags Buffer Overflow Vulnerability

Bugtraq ID:	26945
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 19 2007 12:00AM
Updated:	Dec 20 2007 07:21PM
Credit:	Luigi Auriemma is credited with the discovery of this vulnerability.
Vulnerable:	id3lib id3lib CVS
Not Vulnerable:

id3lib ID3 Tags Buffer Overflow Vulnerability

The 'id3lib' library is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application or to crash the application, denying further service to legitimate users.

This issue affects versions of id3lib committed to the CVS repository; other versions may also be affected.

id3lib ID3 Tags Buffer Overflow Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to open a malicious file using the affected application.

The following exploit code is available:

• /data/vulnerabilities/exploits/id3libexec.c

id3lib ID3 Tags Buffer Overflow Vulnerability

Solution:
Reports indicate that this issue may have been addressed in id3lib 3.8.3, but Symantec has not confirmed this.


id3lib id3lib CVS

• id3lib id3lib-3.8.3.tar.gz
  http://downloads.sourceforge.net/id3lib/id3lib-3.8.3.tar.gz?modtime=10 46563200&big_mirror=0

id3lib ID3 Tags Buffer Overflow Vulnerability

References:

• id3lib Home Page (id3lib)
  
• Array overflow in id3lib (devel CVS) (Luigi Auriemma )