RETIRED: libmikmod Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	38114
Class:	Boundary Condition Error
CVE:	CVE-2009-3995 CVE-2009-3996
Remote:	Yes
Local:	No
Published:	Feb 05 2010 12:00AM
Updated:	Apr 13 2015 10:16PM
Credit:	Dyon Balding, Secunia Research
Vulnerable:	SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SP3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 libmikmod libmikmod 3.1.12 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:

RETIRED: libmikmod Multiple Buffer Overflow Vulnerabilities

The 'libmikmod' library is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage these issues to execute arbitrary code in the context of an application that uses the affected library. Failed attacks will cause denial-of-service conditions.

These issues affect libmikmod 3.1.12; prior versions may also be vulnerable.

RETIRED: This BID is retired because it is a duplicate of BID 37374 (Winamp And libmikmod Module Decoder Plugin Multiple Buffer Overflow Vulnerabilities).

RETIRED: libmikmod Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: libmikmod Multiple Buffer Overflow Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.6.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.6.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 hppa

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_hppa.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_hppa.deb

Debian Linux 5.0 ia-64

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_ia64.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_ia64.deb

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.3.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.3.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.1

• Mandriva libmikmod-devel-3.2.0-0.beta2.7.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.7.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 arm

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_arm.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_arm.deb

Mandriva Linux Mandrake 2009.0

• Mandriva libmikmod-devel-3.2.0-0.beta2.2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 armel

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_armel.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_armel.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.2.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.2.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 alpha

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_alpha.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_alpha.deb

Debian Linux 5.0 amd64

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_amd64.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_amd64.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 ia-32

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_i386.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_i386.deb

Debian Linux 5.0 mips

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_mips.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_mips.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva lib64mikmod-devel-3.1.11a-8.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod2-3.1.11a-8.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva libmikmod-devel-3.2.0-0.beta2.2.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.2.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 s/390

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_s390.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_s390.deb

Mandriva Linux Mandrake 2008.0

• Mandriva libmikmod-devel-3.1.11a-8.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod2-3.1.11a-8.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva lib64mikmod-devel-3.2.0-0.beta2.7.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64mikmod3-3.2.0-0.beta2.7.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 mipsel

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_mipsel.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_mipsel.deb

Debian Linux 5.0 powerpc

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_powerpc.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_powerpc.deb

Mandriva Linux Mandrake 2009.1

• Mandriva libmikmod-devel-3.2.0-0.beta2.3.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.3.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.0

• Mandriva libmikmod-devel-3.2.0-0.beta2.6.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libmikmod3-3.2.0-0.beta2.6.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 sparc

• Debian libmikmod2-dev_3.1.11-a-6+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 -dev_3.1.11-a-6+lenny1_sparc.deb


• Debian libmikmod2_3.1.11-a-6+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/libm/libmikmod/libmikmod2 _3.1.11-a-6+lenny1_sparc.deb

RETIRED: libmikmod Multiple Buffer Overflow Vulnerabilities

References:

• libmikmod Web Site (libmikmod )
  
• Secunia Research: libmikmod Module Parsing Vulnerabilities (Secunia)