Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.

The RedHat Project reports :

Will Drewry of the Google Security Team reported multiple issues in OGG Vorbis and Tremor libraries, that could cause application using those libraries to crash (NULL pointer dereference or divide by zero), enter an infinite loop or cause heap overflow caused by integer overflow.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0270 advisory.

    [1.1.2-3.el5.2]
    - fix release tag     Related: #444707

    [1.1.2-3.el5.1]
    - fix CVE-2008-1420, CVE-2008-1419, CVE-2008-1423     Resolves: #444707

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423)

Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future.

The Ubuntu security team reports :

It was discovered that libvorbis did not correctly handle certain malformed vorbis files. If a user were tricked into opening a specially crafted vorbis file with an application that uses libvorbis, an attacker could cause a denial of service or possibly execute arbitrary code with the user's privileges.

Several security problems were fixed in libvorbis :

  - Division by zero. (CVE-2008-1419)

  - integer overflow. (CVE-2008-1420)

  - integer overflow. (CVE-2008-1423)

It was discovered that libvorbis did not correctly handle certain malformed ogg files. If a user were tricked into opening a specially crafted ogg file with an application that uses libvorbis, an attacker could execute arbitrary code with the user's privileges.
(CVE-2009-2663)

USN-682-1 provided updated libvorbis packages to fix multiple security vulnerabilities. The upstream security patch to fix CVE-2008-1420 introduced a regression when reading sound files encoded with libvorbis 1.0beta1. This update corrects the problem.

It was discovered that libvorbis did not correctly handle certain malformed sound files. If a user were tricked into opening a specially crafted sound file with an application that uses libvorbis, an attacker could execute arbitrary code with the user's privileges.
(CVE-2008-1420).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libvorbis did not correctly handle certain malformed sound files. If a user were tricked into opening a specially crafted sound file with an application that uses libvorbis, an attacker could execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Will Drewry of the Google Security Team reported several vulnerabilities in how libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it would cause an application linked to libvorbis to crash or possibly execute arbitrary code when opened (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423).

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200806-09 (libvorbis: Multiple vulnerabilities)

    Will Drewry of the Google Security Team reported multiple     vulnerabilities in libvorbis:
    A zero value for 'codebook.dim' is not properly handled, leading to a     crash, infinite loop or triggering an integer overflow     (CVE-2008-1419).
    An integer overflow in 'residue partition value' evaluation might lead     to a heap-based buffer overflow (CVE-2008-1420).
    An integer overflow in a certain 'quantvals' and 'quantlist'     calculation might lead to a heap-based buffer overflow     (CVE-2008-1423).
  Impact :

    A remote attacker could exploit these vulnerabilities by enticing a     user to open a specially crafted Ogg Vorbis file or network stream with     an application using libvorbis. This might lead to the execution of     arbitrary code with the privileges of the user playing the file or a     Denial of Service by a crash or CPU consumption.
  Workaround :

    There is no known workaround at this time.

Several local (remote) vulnerabilities have been discovered in libvorbis, a library for the Vorbis general-purpose compressed audio codec. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1419     libvorbis does not properly handle a zero value which     allows remote attackers to cause a denial of service     (crash or infinite loop) or trigger an integer overflow.

  - CVE-2008-1420     Integer overflow in libvorbis allows remote attackers to     execute arbitrary code via a crafted OGG file, which     triggers a heap overflow.

  - CVE-2008-1423     Integer overflow in libvorbis allows remote attackers to     cause a denial of service (crash) or execute arbitrary     code via a crafted OGG file which triggers a heap     overflow.

Several security problems were fixed in libvorbis :

  - CVE-2008-1419 - Division by zero

  - CVE-2008-1420 - integer overflow

  - CVE-2008-1423 - integer overflow

Red Hat reports :

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted [Vorbis] audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened.

Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format.

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423, CVE-2008-2009)

Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future.

Users of libvorbis are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0270 advisory.

    The libvorbis packages contain runtime libraries for use in programs that     support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and     royalty-free, general-purpose compressed audio format.

    Will Drewry of the Google Security Team reported several flaws in the way     libvorbis processed audio data. An attacker could create a carefully     crafted OGG audio file in such a way that it could cause an application     linked with libvorbis to crash, or execute arbitrary code when it was     opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423)

    Moreover, additional OGG file sanity-checks have been added to prevent     possible exploitation of similar issues in the future.

    Users of libvorbis are advised to upgrade to these updated packages, which     contain backported patches to resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format.

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423)

Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future.

Users of libvorbis are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

ID	Name	Product	Family	Severity
85639	FreeBSD : libtremor -- multiple vulnerabilities (3dac84c9-bce1-4199-9784-d68af1eb7b2e)	Nessus	FreeBSD Local Security Checks	high
67690	Oracle Linux 5 : libvorbis (ELSA-2008-0270)	Nessus	Oracle Linux Local Security Checks	high
60399	Scientific Linux Security Update : libvorbis on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
42886	FreeBSD : libvorbis -- multiple vulnerabilities (94edff42-d93d-11de-a434-0211d880e350)	Nessus	FreeBSD Local Security Checks	critical
41213	SuSE9 Security Update : libvorbis (YOU Patch Number 12159)	Nessus	SuSE Local Security Checks	high
40769	Ubuntu 8.04 LTS / 8.10 / 9.04 : libvorbis vulnerability (USN-825-1)	Nessus	Ubuntu Local Security Checks	high
37207	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS : libvorbis vulnerabilities (USN-682-1)	Nessus	Ubuntu Local Security Checks	high
36438	Mandriva Linux Security Advisory : libvorbis (MDVSA-2008:102)	Nessus	Mandriva Local Security Checks	high
33245	GLSA-200806-09 : libvorbis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
33077	Debian DSA-1591-1 : libvorbis - several vulnerabilities	Nessus	Debian Local Security Checks	high
32474	SuSE 10 Security Update : libvorbis (ZYPP Patch Number 5259)	Nessus	SuSE Local Security Checks	high
32473	openSUSE 10 Security Update : libvorbis (libvorbis-5258)	Nessus	SuSE Local Security Checks	high
32388	FreeBSD : libvorbis -- various security issues (f5a76faf-244c-11dd-b143-0211d880e350)	Nessus	FreeBSD Local Security Checks	high
32356	RHEL 2.1 : libvorbis (RHSA-2008:0271)	Nessus	Red Hat Local Security Checks	high
32355	RHEL 4 / 5 : libvorbis (RHSA-2008:0270)	Nessus	Red Hat Local Security Checks	high
32345	Fedora 8 : libvorbis-1.2.0-2.fc8 (2008-3934)	Nessus	Fedora Local Security Checks	high
32342	Fedora 9 : libvorbis-1.2.0-4.fc9 (2008-3910)	Nessus	Fedora Local Security Checks	high
32339	Fedora 7 : libvorbis-1.1.2-4.fc7 (2008-3898)	Nessus	Fedora Local Security Checks	high
32326	CentOS 3 / 4 / 5 : libvorbis (CESA-2008:0270)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2008-1420

critical

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high