Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users to execute arbitrary code via an mp3 file that contains a long string before the @ (at sign) in a URL.

Carlos Barros reports that mpg123 contains two buffer overflows. These vulnerabilities can potentially lead to execution of arbitrary code.

The first buffer overflow can occur when mpg123 parses a URL with a user-name/password field that is more than 256 characters long. This problem can be triggered either locally or remotely via a specially crafted play list. The second potential buffer overflow may be triggered locally by a specially crafted symlink to the mpg123 binary.
This problem is not as serious, since mpg123 is not installed setuid by default.

Carlos Barros has discovered a buffer overflow in the HTTP authentication routine of mpg123, a popular (but non-free) MPEG layer 1/2/3 audio player. If a user opened a malicious playlist or URL, an attacker might execute arbitrary code with the rights of the calling user.

Carlos Barros discovered two buffer overflow vulnerabilities in mpg123; the first in the getauthfromURL() function and the second in the http_open() function. These vulnerabilities could be exploited to possibly execute arbitrary code with the privileges of the user running mpg123.

The provided packages are patched to fix these issues, as well additional boundary checks that were lacking have been included (thanks to the Gentoo Linux Sound Team for these additional fixes).

The remote host is affected by the vulnerability described in GLSA-200410-27 (mpg123: Buffer overflow vulnerabilities)

    Buffer overflow vulnerabilities in the getauthfromURL() and http_open()     functions have been reported by Carlos Barros. Additionally, the Gentoo     Linux Sound Team fixed additional boundary checks which were found to     be lacking.
  Impact :

    By enticing a user to open a malicious playlist or URL or making use of     a specially crafted symlink, an attacker could possibly execute     arbitrary code with the rights of the user running mpg123.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
18866	FreeBSD : mpg123 -- buffer overflow in URL handling (20d16518-2477-11d9-814e-0001020eed82)	Nessus	FreeBSD Local Security Checks	critical
15676	Debian DSA-578-1 : mpg123 - buffer overflow	Nessus	Debian Local Security Checks	critical
15600	Mandrake Linux Security Advisory : mpg123 (MDKSA-2004:120)	Nessus	Mandriva Local Security Checks	critical
15579	GLSA-200410-27 : mpg123: Buffer overflow vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2004-0982

high

Tenable Plugins

critical

critical

critical

critical