Multiple buffer overflows in libmusicbrainz (aka mb_client or MusicBrainz Client Library) 2.1.2 and earlier, and SVN 8406 and earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a long Location header by the HTTP server, which triggers an overflow in the MBHttp::Download function in lib/http.cpp; and (2) a long URL in RDF data, as demonstrated by a URL in an rdf:resource field in an RDF XML document, which triggers overflows in many functions in lib/rdfparse.c.

This update fixes various buffer overflows that can by exploited by malicious servers to execute arbitrary code. (CVE-2006-4197)

Luigi Auriemma discovered multiple buffer overflows in libmusicbrainz.
When a user made queries to MusicBrainz servers, it was possible for malicious servers, or man-in-the-middle systems posing as servers, to send a crafted reply to the client request and remotely gain access to the user's system with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple buffer overflows in libmusicbrainz (aka mb_client or MusicBrainz Client Library) 2.1.2 and earlier, and SVN 8406 and earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a long Location header by the HTTP server, which triggers an overflow in the MBHttp::Download function in lib/http.cpp; and (2) a long URL in RDF data, as demonstrated by a URL in an rdf:resource field in an RDF XML document, which triggers overflows in many functions in lib/rdfparse.c.

The updated packages have been patched to correct this issue.

Update :

Packages are now available for Mandriva Linux 2007.

SecurityFocus reports about libmusicbrainz :

The libmusicbrainz library is prone to multiple buffer-overflow vulnerabilities because the application fails to check the size of the data before copying it into a finite-sized internal memory buffer.

An attacker can exploit these issues to execute arbitrary code within the context of the application or to cause a denial-of-service condition.

The remote host is affected by the vulnerability described in GLSA-200610-09 (libmusicbrainz: Multiple buffer overflows)

    Luigi Auriemma reported a possible buffer overflow in the     MBHttp::Download function of lib/http.cpp as well as several possible     buffer overflows in lib/rdfparse.c.
  Impact :

    A remote attacker could be able to execute arbitrary code or cause     Denial of Service by making use of an overly long 'Location' header in     an HTTP redirect message from a malicious server or a long URL in     malicious RDF feeds.
  Workaround :

    There is no known workaround at this time.

Luigi Auriemma discovered several buffer overflows in libmusicbrainz, a CD index library, that allow remote attackers to cause a denial of service or execute arbitrary code.

ID	Name	Product	Family	Severity
29505	SuSE 10 Security Update : libmusicbrainz (ZYPP Patch Number 2042)	Nessus	SuSE Local Security Checks	high
27943	Ubuntu 5.04 / 5.10 / 6.06 LTS : libmusicbrainz-2.0, libmusicbrainz-2.1 vulnerability (USN-363-1)	Nessus	Ubuntu Local Security Checks	high
27327	openSUSE 10 Security Update : libmusicbrainz (libmusicbrainz-2044)	Nessus	SuSE Local Security Checks	high
23901	Mandrake Linux Security Advisory : musicbrainz (MDKSA-2006:157-1)	Nessus	Mandriva Local Security Checks	high
23761	FreeBSD : libmusicbrainz -- multiple buffer overflow vulnerabilities (ed124f8c-82a2-11db-b46b-0012f06707f0)	Nessus	FreeBSD Local Security Checks	high
22920	GLSA-200610-09 : libmusicbrainz: Multiple buffer overflows	Nessus	Gentoo Local Security Checks	high
22704	Debian DSA-1162-1 : libmusicbrainz-2.0 - buffer overflows	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2006-4197

critical

Tenable Plugins

high

high

high

high

high

high

high