Integer underflow in X MultiMedia System (xmms) 1.2.10 allows user-assisted remote attackers to execute arbitrary code via crafted header information in a skin bitmap image, which results in a stack-based buffer overflow.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - XMMS multiple issues (CVE-2007-0654) (CVE-2007-0653, CVE-2007-0654)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Secunia reports :

Secunia Research has discovered two vulnerabilities in XMMS, which can be exploited by malicious people to compromise a user's system.

1) An integer underflow error exists in the processing of skin bitmap images. This can be exploited to cause a stack-based buffer overflow via specially crafted skin images containing manipulated header information.

Successful exploitation allows execution of arbitrary code.

2) An integer overflow error exists in the processing of skin bitmap images. This can be exploited to cause memory corruption via specially crafted skin images containing manipulated header information.

Successful exploitation may allow the execution of arbitrary code.

Two integer overflows when processing BMP skin images potentially allows attackers to execute arbitrary code via specially crafted files. (CVE-2007-0653 / CVE-2007-0654)

Sven Krewitt of Secunia Research discovered that XMMS did not correctly handle BMP images when loading GUI skins. If a user were tricked into loading a specially crafted skin, a remote attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two integer overflows when processing BMP skin images potentially allows attackers to execute arbitrary code via specially crafted files (CVE-2007-0653,CVE-2007-0654).

Multiple errors have been found in the skin handling routines in xmms, the X Multimedia System. These vulnerabilities could allow an attacker to run arbitrary code as the user running xmms by inducing the victim to load specially crafted interface skin files.

ID	Name	Product	Family	Severity
198440	RHEL 4 : xmms (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
72872	FreeBSD : xmms -- Integer Overflow And Underflow Vulnerabilities (20e23b65-a52e-11e3-ae3a-00224d7c32a2)	Nessus	FreeBSD Local Security Checks	high
41122	SuSE9 Security Update : XMMS (YOU Patch Number 11483)	Nessus	SuSE Local Security Checks	high
29602	SuSE 10 Security Update : XMMS (ZYPP Patch Number 3075)	Nessus	SuSE Local Security Checks	high
28042	Ubuntu 5.10 / 6.06 LTS / 6.10 : xmms vulnerabilities (USN-445-1)	Nessus	Ubuntu Local Security Checks	high
27490	openSUSE 10 Security Update : xmms (xmms-3073)	Nessus	SuSE Local Security Checks	high
25011	Debian DSA-1277-1 : XMMS - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-0654

high

Tenable Plugins

high

high

high

high

high

high

high