PT-2004-2229 · Yamt · Yamt

Publicado 2004-12-22 · Atualizado 2017-07-11 · CVE-2004-1302

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: YAMT version 0.5

Description: The issue allows remote attackers to execute arbitrary commands via an MP3 file with double quotes in the Artist tag. This is due to a problem in the id3tag sort function in id3tag.c.

Recommendations: For YAMT version 0.5, consider disabling the id3tag sort function until a patch is available to prevent exploitation. Restrict access to MP3 files with double quotes in the Artist tag to minimize the risk of arbitrary command execution.

Exploit

Correção

Identificadores relacionados

CVE-2004-1302

Produtos afetados

Yamt

Referências · 7

• 🔥 http://tigger.uic.edu/~jlongs2/holes/yamt.txt · Exploit
• http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1302 · Nota de Segurança
• http://securitytracker.com/id?1012583 · Nota
• http://secunia.com/advisories/13554 · Nota
• http://securityfocus.com/bid/11999 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18614 · Nota