Light Alloy '.m3u' File Remote Buffer Overflow Vulnerability
BID:63895
Info
Light Alloy '.m3u' File Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 63895 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2013-6874 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 22 2013 12:00AM |
| Updated: | Jan 09 2014 03:51PM |
| Credit: | Mike Czumak |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Light Alloy '.m3u' File Remote Buffer Overflow Vulnerability
Light Alloy is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Light Alloy 4.7.3 is vulnerable; other versions may also be affected.
Light Alloy is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Light Alloy 4.7.3 is vulnerable; other versions may also be affected.
Exploit / POC
Light Alloy '.m3u' File Remote Buffer Overflow Vulnerability
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product.
The following exploit is available:
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product.
The following exploit is available:
Solution / Fix
Light Alloy '.m3u' File Remote Buffer Overflow Vulnerability
Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
References
Light Alloy '.m3u' File Remote Buffer Overflow Vulnerability
References:
References: