mpg123 'store_id3_text()' Memory Corruption Vulnerability

Bugtraq ID:	34381
Class:	Design Error
CVE:	CVE-2009-1301
Remote:	Yes
Local:	No
Published:	Apr 05 2009 12:00AM
Updated:	Jan 05 2011 09:32PM
Credit:	The vendor.
Vulnerable:	Pardus Linux 2008 0 mpg123 mpg123 1.7.1 mpg123 mpg123 1.7 MandrakeSoft Linux Mandrake 2009.0 x86_64 MandrakeSoft Linux Mandrake 2009.0 MandrakeSoft Linux Mandrake 2008.1 x86_64 MandrakeSoft Linux Mandrake 2008.1 MandrakeSoft Linux Mandrake 2008.0 x86_64 MandrakeSoft Linux Mandrake 2008.0 Gentoo Linux
Not Vulnerable:	mpg123 mpg123 1.7.2

mpg123 'store_id3_text()' Memory Corruption Vulnerability

The 'mpg123' program is prone to a memory-corruption vulnerability because it fails to properly bounds-check user-supplied input before copying it into a finite-sized buffer.

Exploiting this issue may allow a remote attacker to overwrite memory with arbitrary data, potentially allowing them to execute malicious machine code in the context of the affected application and to compromise the affected computer.

This issue affects mpg123 1.7.1 and earlier.

mpg123 'store_id3_text()' Memory Corruption Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

mpg123 'store_id3_text()' Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Linux Mandrake 2009.0 x86_64

• Mandriva mpg123-nas-1.5.1-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-portaudio-1.5.1-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-jack-1.5.1-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-arts-1.5.1-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mpg123_0-1.5.1-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-sdl-1.5.1-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mpg123-devel-1.5.1-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-1.5.1-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-esd-1.5.1-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-pulse-1.5.1-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Linux Mandrake 2008.1 x86_64

• Mandriva mpg123-jack-1.3.0-2.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-esd-1.3.0-2.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-1.3.0-2.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-portaudio-1.3.0-2.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-sdl-1.3.0-2.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-pulse-1.3.0-2.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-arts-1.3.0-2.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-nas-1.3.0-2.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mpg123_0-1.3.0-2.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mpg123-devel-1.3.0-2.1mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Linux Mandrake 2008.0 x86_64

• Mandriva mpg123-0.66-2.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Linux Mandrake 2008.1

• Mandriva mpg123-arts-1.3.0-2.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmpg123_0-1.3.0-2.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-nas-1.3.0-2.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-1.3.0-2.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-pulse-1.3.0-2.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-jack-1.3.0-2.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-sdl-1.3.0-2.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-portaudio-1.3.0-2.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmpg123-devel-1.3.0-2.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-esd-1.3.0-2.1mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Linux Mandrake 2008.0

• Mandriva mpg123-0.66-2.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Linux Mandrake 2009.0

• Mandriva libmpg123-devel-1.5.1-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-1.5.1-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-portaudio-1.5.1-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-pulse-1.5.1-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-nas-1.5.1-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-jack-1.5.1-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-sdl-1.5.1-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmpg123_0-1.5.1-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-arts-1.5.1-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mpg123-esd-1.5.1-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

mpg123 mpg123 1.7

• mpg123 mpg123-1.7.2.tar.bz
  http://sourceforge.net/project/downloading.php?group_id=135704&use_mir ror=heanet&filename=mpg123-1.7.2.tar.bz2&a=72120632

mpg123 mpg123 1.7.1

• mpg123 mpg123-1.7.2.tar.bz
  http://sourceforge.net/project/downloading.php?group_id=135704&use_mir ror=heanet&filename=mpg123-1.7.2.tar.bz2&a=72120632

mpg123 'store_id3_text()' Memory Corruption Vulnerability

References:

• mpg123 Home Page (mpg123)
  
• Release Name: 1.7.2 (mpg123)