OpenCore 'pvmp3_huffman_parsing.cpp' Remote Buffer Underflow Vulnerability

Bugtraq ID:	33673
Class:	Boundary Condition Error
CVE:	CVE-2009-0475
Remote:	Yes
Local:	No
Published:	Feb 07 2009 12:00AM
Updated:	Feb 10 2009 11:58PM
Credit:	Owen Arden and Charlie Miller
Vulnerable:	Open Handset Alliance OpenCORE 2.0 Open Handset Alliance Android 0 Google Android 0
Not Vulnerable:	Open Handset Alliance OpenCORE 2.0.8815 Open Handset Alliance Android Change 8815

OpenCore 'pvmp3_huffman_parsing.cpp' Remote Buffer Underflow Vulnerability

OpenCore is prone to a remote buffer-underflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code in the context of the user running an application that uses the affected library. Failed exploit attempts will likely crash the application.

OpenCore 'pvmp3_huffman_parsing.cpp' Remote Buffer Underflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenCore 'pvmp3_huffman_parsing.cpp' Remote Buffer Underflow Vulnerability

Solution:
A vendor patch is available. Please see the references for more information.

OpenCore 'pvmp3_huffman_parsing.cpp' Remote Buffer Underflow Vulnerability

References:

• Android Open Source Project Homepage (Android Open Source Project)
  
• Change 8815: patch for oCERT_2009-002, CVE-2009-0475 ran through astyle for form (Greg Sherwood)
  
• [oCERT-2009-002] OpenCORE insufficient bounds checking during MP3 decoding (Will Drewry )