Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure.

This update of amarok fixes several integer overflows and unchecked memory allocations that can be exploited by malformed Audible digital audio files. These bugs could be used in a user-assisted attack scenario to execute arbitrary code remotely. (CVE-2009-0135 / CVE-2009-0136)

This update of amarok fixes several integer overflows and unchecked memory allocations that can be exploited by malformed Audible digital audio files. These bugs could be used in a user-assisted attack scenario to execute arbitrary code remotely. (CVE-2009-0135, CVE-2009-0136)

It was discovered that Amarok did not correctly handle certain malformed tags in Audible Audio (.aa) files. If a user were tricked into opening a crafted Audible Audio file, an attacker could execute arbitrary code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Data length values in metadata Audible Audio media file (.aa) can lead to an integer overflow enabling remote attackers use it to trigger an heap overflow and enabling the possibility to execute arbitrary code (CVE-2009-0135).

Failure on checking heap allocation on Audible Audio media files (.aa) allows remote attackers either to cause denial of service or execute arbitrary code via a crafted media file (CVE-2009-0136).

This update provide the fix for these security issues.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Secunia reports :

Tobias Klein has reported some vulnerabilities in Amarok, which potentially can be exploited by malicious people to compromise a user's system.

Two integer overflow errors exist within the 'Audible::Tag::readTag()' function in src/metadata/audible/audibletag.cpp. These can be exploited to cause heap-based buffer overflows via specially crafted Audible Audio files.

Two errors within the 'Audible::Tag::readTag()' function in src/metadata/audible/audibletag.cpp can be exploited to corrupt arbitrary memory via specially crafted Audible Audio files.

The remote host is affected by the vulnerability described in GLSA-200903-34 (Amarok: User-assisted execution of arbitrary code)

    Tobias Klein has discovered multiple vulnerabilities in Amarok:
    Multiple integer overflows in the Audible::Tag::readTag()     function in metadata/audible/audibletag.cpp trigger heap-based buffer     overflows (CVE-2009-0135).
    Multiple array index errors in the     Audible::Tag::readTag() function in metadata/audible/audibletag.cpp can     lead to invalid pointer dereferences, or the writing of a 0x00 byte to     an arbitrary memory location after an allocation failure     (CVE-2009-0136).
  Impact :

    A remote attacker could entice a user to open a specially crafted     Audible Audio (.aa) file with a large 'nlen' or 'vlen' tag value to     execute arbitrary code or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

This build includes a security fix concerning the parsing of malformed Audible digital audio files.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tobias Klein discovered that integer overflows in the code the Amarok media player uses to parse Audible files may lead to the execution of arbitrary code.

ID	Name	Product	Family	Severity
51717	SuSE 10 Security Update : amarok (ZYPP Patch Number 5931)	Nessus	SuSE Local Security Checks	high
40185	openSUSE Security Update : amarok (amarok-436)	Nessus	SuSE Local Security Checks	high
39909	openSUSE Security Update : amarok (amarok-436)	Nessus	SuSE Local Security Checks	high
37607	Ubuntu 7.10 / 8.04 LTS / 8.10 : amarok vulnerabilities (USN-739-1)	Nessus	Ubuntu Local Security Checks	high
36306	Mandriva Linux Security Advisory : amarok (MDVSA-2009:030-1)	Nessus	Mandriva Local Security Checks	high
35999	FreeBSD : amarok -- multiple vulnerabilities (6bb6188c-17b2-11de-ae4d-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
35985	GLSA-200903-34 : Amarok: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
35552	openSUSE 10 Security Update : amarok (amarok-5932)	Nessus	SuSE Local Security Checks	high
35439	Fedora 9 : amarok-1.4.10-2.fc9 (2009-0715)	Nessus	Fedora Local Security Checks	high
35383	Debian DSA-1706-1 : amarok - integer overflows	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2009-0136

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high