Multiple stack-based buffer overflows in the LookupTRM::lookup function in libtunepimp (TunePimp) 0.4.2 allow remote user-assisted attackers to cause a denial of service (application crash) and possibly execute code via a long (1) Album release date (MBE_ReleaseGetDate), (2) data, or (3) error strings.

Kevin Kofler discovered several buffer overflows in the tag parser. By tricking a user into opening a specially crafted tagged multimedia file (such as .ogg or .mp3 music) with an application that uses libtunepimp, this could be exploited to execute arbitrary code with the user's privileges. 

This particularly affects the KDE applications 'Amarok' and 'Juk'.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kevin Kofler discovered multiple stack-based buffer overflows in the LookupTRM::lookup function in libtunepimp 0.4.2 that allow remote user-complicit attackers to cause a denial of service (application crash) and possibly execute code via a long (1) Album release date (MBE_ReleaseGetDate), (2) data, or (3) error strings.

Updated packages have been patched to correct this issue.

Kevin Kofler discovered several stack-based buffer overflows in the LookupTRM::lookup function in libtunepimp, a MusicBrainz tagging library, which allows remote attackers to cause a denial of service or execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200607-11 (TunePimp: Buffer overflow)

    Kevin Kofler has reported a vulnerability where three stack variables     are allocated with 255, 255 and 100 bytes respectively, yet 256 bytes     are read into each. This could lead to buffer overflows.
  Impact :

    Running an affected version of TunePimp could lead to the execution of     arbitrary code by a remote attacker.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
27894	Ubuntu 5.04 / 5.10 / 6.06 LTS : libtunepimp vulnerability (USN-318-1)	Nessus	Ubuntu Local Security Checks	medium
23877	Mandrake Linux Security Advisory : libtunepimp (MDKSA-2006:126)	Nessus	Mandriva Local Security Checks	medium
22677	Debian DSA-1135-1 : libtunepimp - buffer overflow	Nessus	Debian Local Security Checks	medium
22119	GLSA-200607-11 : TunePimp: Buffer overflow	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2006-3600

critical

Tenable Plugins

medium

medium

medium

medium