Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image that contains a long joilet file name.

A stack-based buffer overflow was discovered in libcdio that allowed context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image file that contains a long joliet file name.

In addition, a fix for failed UTF-8 conversions that would cause a segfault on certain ISOs was also fixed.

The updated packages have been patched to correct this issue.

Long file names in ISO file systems with Joliet extension could cause a buffer overflow in libcdio (CVE-2007-6613).

Long file names in ISO file systems with Joliet extension could cause a buffer overflow in libcdio. (CVE-2007-6613)

Devon Miller discovered that the iso-info and cd-info tools did not properly perform bounds checking. If a user were tricked into using these tools with a crafted iso image, an attacker could cause a denial of service (core dump) and possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200801-08 (libcdio: User-assisted execution of arbitrary code)

    Devon Miller reported a boundary error in the 'print_iso9660_recurse()'     function in files cd-info.c and iso-info.c when processing long     filenames within Joliet images.
  Impact :

    A remote attacker could entice a user to open a specially crafted ISO     image in the cd-info and iso-info applications, resulting in the     execution of arbitrary code with the privileges of the user running the     application. Applications linking against shared libraries of libcdio     are not affected.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
36449	Mandriva Linux Security Advisory : libcdio (MDVSA-2008:037)	Nessus	Mandriva Local Security Checks	medium
31403	openSUSE 10 Security Update : libcdio (libcdio-5061)	Nessus	SuSE Local Security Checks	medium
31402	SuSE 10 Security Update : libcdio (ZYPP Patch Number 5060)	Nessus	SuSE Local Security Checks	medium
31401	openSUSE 10 Security Update : libcdio (libcdio-5059)	Nessus	SuSE Local Security Checks	medium
31165	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : libcdio vulnerability (USN-580-1)	Nessus	Ubuntu Local Security Checks	medium
30032	GLSA-200801-08 : libcdio: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2007-6613

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium