libmikmod Multiple Sound Channel Media Playback Remote Denial of Service Vulnerability

Bugtraq ID:	33235
Class:	Design Error
CVE:	CVE-2007-6720
Remote:	Yes
Local:	No
Published:	Jan 13 2009 12:00AM
Updated:	Jul 06 2016 02:30PM
Credit:	Brandon
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SuSE openSUSE 10.3 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 RedHat Enterprise Linux WS 5 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux WS 2.1 IA64 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux ES 4.8.z RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux ES 2.1 IA64 RedHat Enterprise Linux ES 2.1 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Desktop 4.0 RedHat Desktop 3.0 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4.8.z Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux AS 2.1 IA64 Red Hat Enterprise Linux AS 2.1 Red Hat Enterprise Linux 5 Server Pardus Linux 2008 0 mikmod mikmod 3.2.1 mikmod mikmod 3.1.6 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 libmikmod libmikmod 3.2 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

libmikmod Multiple Sound Channel Media Playback Remote Denial of Service Vulnerability

The 'libmikmod' library is prone to a remote denial-of-service vulnerability because the software fails to perform adequate boundary checks on user-supplied input.

Attackers can exploit this issue by enticing an unsuspecting victim to open multiple specially crafted media files.

Successfully exploiting this issue will cause an affected application to crash, denying service to legitimate users. Attackers may also be able to run arbitrary code, but this has not been confirmed.

This issue affects libmikmod 3.1.9 through 3.2.0; other versions or applications that use the library may also be affected.

libmikmod Multiple Sound Channel Media Playback Remote Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

libmikmod Multiple Sound Channel Media Playback Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu4.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu4.1_sparc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu4.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu4.1_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.8.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.8.04.1_powerpc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.8.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.8.04.1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.8.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.8.04.1_sparc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.8.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.8.04.1_sparc.deb

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu4.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu4.1_powerpc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu4.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu4.1_powerpc.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva lib64mikmod-devel-3.1.11a-8.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod2-3.1.11a-8.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.8.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu3.8.04.1_amd64.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.8.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu3.8.04.1_amd64.deb

Mandriva Linux Mandrake 2008.0

• Mandriva libmikmod-devel-3.1.11a-8.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod2-3.1.11a-8.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu4.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu4.1_lpia.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu4.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu4.1_lpia.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.9.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.9.04.1_sparc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.9.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.9.04.1_sparc.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.9.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.9.04.1_powerpc.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.9.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.9.04.1_powerpc.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.9.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu3.9.04.1_i386.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.9.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu3.9.04.1_i386.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.9.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.9.04.1_lpia.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.9.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.9.04.1_lpia.deb

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu4.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu4.1_i386.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu4.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu4.1_i386.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu4.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu4.1_amd64.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu4.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu4.1_amd64.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.2.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.2.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.9.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu3.9.04.1_amd64.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.9.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu3.9.04.1_amd64.deb

Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva lib64mikmod-devel-3.1.11a-10.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod2-3.1.11a-10.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.1

• Mandriva libmikmod-devel-3.1.11a-10.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod2-3.1.11a-10.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.2.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.2.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva libmikmod-devel-3.2.0-0.beta2.2.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.2.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.8.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2-dev_3.1.11 -a-6ubuntu3.8.04.1_lpia.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.8.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libm/libmikmod/libmikmod2_3.1.11-a-6 ubuntu3.8.04.1_lpia.deb

Mandriva Linux Mandrake 2009.0

• Mandriva libmikmod-devel-3.2.0-0.beta2.2.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.2.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu libmikmod2-dev_3.1.11-a-6ubuntu3.8.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2- dev_3.1.11-a-6ubuntu3.8.04.1_i386.deb


• Ubuntu libmikmod2_3.1.11-a-6ubuntu3.8.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libm/libmikmod/libmikmod2_ 3.1.11-a-6ubuntu3.8.04.1_i386.deb

libmikmod Multiple Sound Channel Media Playback Remote Denial of Service Vulnerability

References:

• Bug 479829 - mikmod, libmikmod: app crash or abort when loading/playing multip (Jan Lieskovsky)
  
• CVE Request -- libmikmod (Jan Lieskovsky)
  
• libmikmod causes app to segfault or abort when loading multiple music files with (Brandon)
  
• mikmod Homepage (Raphaël Assénat)
  
• Oracle Solaris Third Party Bulletin - April 2016 (Oracle)
  
• RHSA-2010:0720 mikmod security update (Red Hat)