Off-by-one error in the CSoundFile::ReadDSM function in src/load_dms.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted DSM file with a large number of samples.

The remote Redhat Enterprise Linux 3 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libmodplug: multiple vulnerabilities reported in <= 0.8.8.3 (CVE-2011-2911, CVE-2011-2915)

  - Stack-based buffer overflow in the CSoundFile::ReadS3M function in src/load_s3m.cpp in libmodplug before     0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a     crafted S3M file with an invalid offset. (CVE-2011-2912)

  - Off-by-one error in the CSoundFile::ReadAMS function in src/load_ams.cpp in libmodplug before 0.8.8.4     allows remote attackers to cause a denial of service (stack memory corruption) and possibly execute     arbitrary code via a crafted AMS file with a large number of samples. (CVE-2011-2913)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update of libmodplug0 fixes the following issues :

1) An integer overflow error exists within the 'CSoundFile::ReadWav()' function (src/load_wav.cpp) when processing certain WAV files. This can be exploited to cause a heap-based buffer overflow by tricking a user into opening a specially crafted WAV file. (CVE-2011-2911)

2) Boundary errors within the 'CSoundFile::ReadS3M()' function (src/load_s3m.cpp) when processing S3M files can be exploited to cause stack-based buffer overflows by tricking a user into opening a specially crafted S3M file. (CVE-2011-2912)

3) An off-by-one error within the 'CSoundFile::ReadAMS()' function (src/load_ams.cpp) can be exploited to cause a stack corruption by tricking a user into opening a specially crafted AMS file.
(CVE-2011-2913)

4) An off-by-one error within the 'CSoundFile::ReadDSM()' function (src/load_dms.cpp) can be exploited to cause a memory corruption by tricking a user into opening a specially crafted DSM file.
(CVE-2011-2914)

5) An off-by-one error within the 'CSoundFile::ReadAMS2()' function (src/load_ams.cpp) can be exploited to cause a memory corruption by tricking a user into opening a specially crafted AMS file.
(CVE-2011-2915)

Also an overflow in the ABC loader was fixed. (CVE-2011-1761)

From Red Hat Security Advisory 2011:1264 :

Updated gstreamer-plugins packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The gstreamer-plugins packages contain plug-ins used by the GStreamer streaming-media framework to support a wide variety of media formats.

An integer overflow flaw, a boundary error, and multiple off-by-one flaws were found in various ModPlug music file format library (libmodplug) modules, embedded in GStreamer. An attacker could create specially crafted music files that, when played by a victim, would cause applications using GStreamer to crash or, potentially, execute arbitrary code. (CVE-2011-2911, CVE-2011-2912, CVE-2011-2913, CVE-2011-2914, CVE-2011-2915)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing the update, all applications using GStreamer (such as Rhythmbox) must be restarted for the changes to take effect.

The remote host is affected by the vulnerability described in GLSA-201203-16 (ModPlug: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been found in ModPlug:
      The ReadS3M method in load_s3m.cpp fails to validate user-supplied         information, which could cause a stack-based buffer overflow         (CVE-2011-1574).
      The 'CSoundFile::ReadWav()' function in load_wav.cpp contains an         integer overflow which could cause a heap-based buffer overflow         (CVE-2011-2911).
      The 'CSoundFile::ReadS3M()' function in load_s3m.cpp contains         multiple boundary errors which could cause a stack-based buffer         overflow (CVE-2011-2912).
      The 'CSoundFile::ReadAMS()' function in load_ams.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2913).
      The 'CSoundFile::ReadDSM()' function in load_dms.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2914).
      The 'CSoundFile::ReadAMS2()' function in load_ams.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2915).
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file, possibly resulting in execution of arbitrary code, or a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201203-14 (Audacious Plugins: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been found in Audacious Plugins:
      The 'CSoundFile::ReadWav()' function in load_wav.cpp contains an         integer overflow which could cause a heap-based buffer overflow         (CVE-2011-2911).
      The 'CSoundFile::ReadS3M()' function in load_s3m.cpp contains         multiple boundary errors which could cause a stack-based buffer         overflow (CVE-2011-2912).
      The 'CSoundFile::ReadAMS()' function in load_ams.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2913).
      The 'CSoundFile::ReadDSM()' function in load_dms.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2914).
      The 'CSoundFile::ReadAMS2()' function in load_ams.cpp contains an         off-by-one error which could cause memory corruption (CVE-2011-2915).
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file, possibly resulting in execution of arbitrary code, or a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities that can lead to the execution of arbitrary code have been discovered in libmodplug, a library for MOD music based on ModPlug. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2011-1761     epiphant discovered that the abc file parser is     vulnerable to several stack-based buffer overflows that     potentially lead to the execution of arbitrary code.

  - CVE-2011-2911     Hossein Lotfi of Secunia discovered that the     CSoundFile::ReadWav function is vulnerable to an integer     overflow which leads to a heap-based buffer overflow. An     attacker can exploit this flaw to potentially execute     arbitrary code by tricking a victim into opening crafted     WAV files.

  - CVE-2011-2912     Hossein Lotfi of Secunia discovered that the     CSoundFile::ReadS3M function is vulnerable to a     stack-based buffer overflow. An attacker can exploit     this flaw to potentially execute arbitrary code by     tricking a victim into opening crafted S3M files.

  - CVE-2011-2913     Hossein Lotfi of Secunia discovered that the     CSoundFile::ReadAMS function suffers from an off-by-one     vulnerability that leads to memory corruption. An     attacker can exploit this flaw to potentially execute     arbitrary code by tricking a victim into opening crafted     AMS files.

  - CVE-2011-2914     It was discovered that the CSoundFile::ReadDSM function     suffers from an off-by-one vulnerability that leads to     memory corruption. An attacker can exploit this flaw to     potentially execute arbitrary code by tricking a victim     into opening crafted DSM files.

  - CVE-2011-2915     It was discovered that the CSoundFile::ReadAMS2 function     suffers from an off-by-one vulnerability that leads to     memory corruption. An attacker can exploit this flaw to     potentially execute arbitrary code by tricking a victim     into opening crafted AMS files.

Hossein Lotfi discovered that libmodplug did not correctly handle certain malformed media files. If a user or automated system were tricked into opening a crafted media file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. (CVE-2011-2911, CVE-2011-2912, CVE-2011-2913)

It was discovered that libmodplug did not correctly handle certain malformed media files. If a user or automated system were tricked into opening a crafted media file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. (CVE-2011-2914, CVE-2011-2915).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Patch to use the system's libmodplug library.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated gstreamer-plugins packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The gstreamer-plugins packages contain plug-ins used by the GStreamer streaming-media framework to support a wide variety of media formats.

An integer overflow flaw, a boundary error, and multiple off-by-one flaws were found in various ModPlug music file format library (libmodplug) modules, embedded in GStreamer. An attacker could create specially crafted music files that, when played by a victim, would cause applications using GStreamer to crash or, potentially, execute arbitrary code. (CVE-2011-2911, CVE-2011-2912, CVE-2011-2913, CVE-2011-2914, CVE-2011-2915)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing the update, all applications using GStreamer (such as Rhythmbox) must be restarted for the changes to take effect.

Update to upstream version 0.8.8.4.

http://modplug-xmms.sourceforge.net/#news http://secunia.com/advisories/45131

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199360	RHEL 3 : gstreamer-plugins (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
75902	openSUSE Security Update : libmodplug (openSUSE-SU-2011:0943-1)	Nessus	SuSE Local Security Checks	medium
75586	openSUSE Security Update : libmodplug (openSUSE-SU-2011:0943-1)	Nessus	SuSE Local Security Checks	medium
68345	Oracle Linux 4 : gstreamer-plugins (ELSA-2011-1264)	Nessus	Oracle Linux Local Security Checks	medium
58381	GLSA-201203-16 : ModPlug: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
58379	GLSA-201203-14 : Audacious Plugins: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
58078	Debian DSA-2415-1 : libmodplug - several vulnerabilities	Nessus	Debian Local Security Checks	medium
56767	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : libmodplug vulnerabilities (USN-1255-1)	Nessus	Ubuntu Local Security Checks	medium
56224	Fedora 14 : audacious-plugins-2.4.5-4.fc14 (2011-12370)	Nessus	Fedora Local Security Checks	medium
56126	CentOS 4 : gstreamer-plugins (CESA-2011:1264)	Nessus	CentOS Local Security Checks	medium
56111	RHEL 4 : gstreamer-plugins (RHSA-2011:1264)	Nessus	Red Hat Local Security Checks	medium
55946	Fedora 16 : libmodplug-0.8.8.4-1.fc16 (2011-10452)	Nessus	Fedora Local Security Checks	medium
55870	Fedora 15 : libmodplug-0.8.8.4-1.fc15 (2011-10544)	Nessus	Fedora Local Security Checks	medium
55869	Fedora 14 : libmodplug-0.8.8.4-1.fc14 (2011-10503)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-2914

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium