libmodplug CVE-2013-4233 Integer Overflow Vulnerability

Bugtraq ID:	61713
Class:	Input Validation Error
CVE:	CVE-2013-4233
Remote:	Yes
Local:	No
Published:	Aug 09 2013 12:00AM
Updated:	Apr 13 2015 09:41PM
Credit:	SCRT Information Security
Vulnerable:	VideoLAN VLC media player 2.0.8 S.u.S.E. openSUSE 12.3 S.u.S.E. openSUSE 12.2 S.u.S.E. openSUSE 11.4 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 libmodplug libmodplug 0.8.8.4 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

libmodplug CVE-2013-4233 Integer Overflow Vulnerability

libmodplug is prone to an integer-overflow vulnerability because it fails to properly bounds check user-supplied input before copying it into an insufficiently sized buffer.



Attackers can exploit this issue to execute arbitrary code within the context of the user running the affected application. Failed attempts will likely cause a denial-of-service condition.



libmodplug 0.8.8.4 is vulnerable; other versions may also be affected.

libmodplug CVE-2013-4233 Integer Overflow Vulnerability

References:

• libmodplug / src / load_abc.cpp (gardaud)
  
• libmodplug Homepage (libmodplug)
  
• Re: CVE Request - LibModPlug <=0.8.8.4 multiple heap overflow (Kurt Seifried)
  
• VLC + ABC parsing seems to be a CTF challenge (agixid)