Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro functions in src/load_abc.cpp in libmodplug before 0.8.8.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ABC file. NOTE: some of these details are obtained from third party information.

This update of libmodplug0 fixes the following issues :

1) An integer overflow error exists within the 'CSoundFile::ReadWav()' function (src/load_wav.cpp) when processing certain WAV files. This can be exploited to cause a heap-based buffer overflow by tricking a user into opening a specially crafted WAV file. (CVE-2011-2911)

2) Boundary errors within the 'CSoundFile::ReadS3M()' function (src/load_s3m.cpp) when processing S3M files can be exploited to cause stack-based buffer overflows by tricking a user into opening a specially crafted S3M file. (CVE-2011-2912)

3) An off-by-one error within the 'CSoundFile::ReadAMS()' function (src/load_ams.cpp) can be exploited to cause a stack corruption by tricking a user into opening a specially crafted AMS file.
(CVE-2011-2913)

4) An off-by-one error within the 'CSoundFile::ReadDSM()' function (src/load_dms.cpp) can be exploited to cause a memory corruption by tricking a user into opening a specially crafted DSM file.
(CVE-2011-2914)

5) An off-by-one error within the 'CSoundFile::ReadAMS2()' function (src/load_ams.cpp) can be exploited to cause a memory corruption by tricking a user into opening a specially crafted AMS file.
(CVE-2011-2915)

Also an overflow in the ABC loader was fixed. (CVE-2011-1761)

specially crafted files could cause a stack overflow in libmodplug (CVE-2011-1761). libmodplug version 0.8.8.3 fixes the problem.

Several vulnerabilities that can lead to the execution of arbitrary code have been discovered in libmodplug, a library for MOD music based on ModPlug. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2011-1761     epiphant discovered that the abc file parser is     vulnerable to several stack-based buffer overflows that     potentially lead to the execution of arbitrary code.

  - CVE-2011-2911     Hossein Lotfi of Secunia discovered that the     CSoundFile::ReadWav function is vulnerable to an integer     overflow which leads to a heap-based buffer overflow. An     attacker can exploit this flaw to potentially execute     arbitrary code by tricking a victim into opening crafted     WAV files.

  - CVE-2011-2912     Hossein Lotfi of Secunia discovered that the     CSoundFile::ReadS3M function is vulnerable to a     stack-based buffer overflow. An attacker can exploit     this flaw to potentially execute arbitrary code by     tricking a victim into opening crafted S3M files.

  - CVE-2011-2913     Hossein Lotfi of Secunia discovered that the     CSoundFile::ReadAMS function suffers from an off-by-one     vulnerability that leads to memory corruption. An     attacker can exploit this flaw to potentially execute     arbitrary code by tricking a victim into opening crafted     AMS files.

  - CVE-2011-2914     It was discovered that the CSoundFile::ReadDSM function     suffers from an off-by-one vulnerability that leads to     memory corruption. An attacker can exploit this flaw to     potentially execute arbitrary code by tricking a victim     into opening crafted DSM files.

  - CVE-2011-2915     It was discovered that the CSoundFile::ReadAMS2 function     suffers from an off-by-one vulnerability that leads to     memory corruption. An attacker can exploit this flaw to     potentially execute arbitrary code by tricking a victim     into opening crafted AMS files.

It was discovered that libmodplug did not correctly handle certain malformed S3M media files. If a user or automated system were tricked into opening a crafted S3M file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. (CVE-2011-1574)

It was discovered that libmodplug did not correctly handle certain malformed ABC media files. If a user or automated system were tricked into opening a crafted ABC file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. (CVE-2011-1761)

The default compiler options for affected releases should reduce the vulnerability to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to upstream version 0.8.8.3 (CVE-2011-1761).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75902	openSUSE Security Update : libmodplug (openSUSE-SU-2011:0943-1)	Nessus	SuSE Local Security Checks	medium
75901	openSUSE Security Update : libmodplug (openSUSE-SU-2011:0551-1)	Nessus	SuSE Local Security Checks	medium
75586	openSUSE Security Update : libmodplug (openSUSE-SU-2011:0943-1)	Nessus	SuSE Local Security Checks	medium
75585	openSUSE Security Update : libmodplug (openSUSE-SU-2011:0551-1)	Nessus	SuSE Local Security Checks	medium
58078	Debian DSA-2415-1 : libmodplug - several vulnerabilities	Nessus	Debian Local Security Checks	medium
55114	Ubuntu 10.04 LTS / 10.10 / 11.04 : libmodplug vulnerabilities (USN-1148-1)	Nessus	Ubuntu Local Security Checks	medium
54635	Fedora 14 : libmodplug-0.8.8.3-3.fc14 (2011-6931)	Nessus	Fedora Local Security Checks	medium
54575	Fedora 15 : libmodplug-0.8.8.3-3.fc15 (2011-6995)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-1761

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium