PT-2006-4730 · Mikmod+1 · Mikmod Sound System+1

Luigi Auriemma · Publicado 2006-07-27 · Atualizado 2018-10-17 · CVE-2006-3879

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mikmod Sound System version 3.2.2

Description The issue is related to an integer overflow in the loadChunk function in loaders/load gt2.c, which can be triggered by a remote attacker using a specially crafted GRAOUMF TRACKER (GT2) module file. This file would contain a large comment length value (0xffffffff) in an XCOM chunk, leading to a denial of service.

Recommendations For Mikmod Sound System version 3.2.2, consider disabling the loadChunk function in loaders/load gt2.c as a temporary workaround until a patch is available. Restrict access to GT2 module files to minimize the risk of exploitation. Avoid using the loadChunk function with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

ALT-PU-2014-2127

CVE-2006-3879

Produtos afetados

Alt Linux

Mikmod Sound System

Referências · 12

• 🔥 https://exploit-db.com/exploits/2073 · Exploit
• 🔥 http://aluigi.org/poc/lmmgt2ho.zip · Exploit
• 🔥 http://securityfocus.com/bid/19134 · Exploit
• 🔥 http://aluigi.altervista.org/adv/lmmgt2ho-adv.txt · Exploit
• http://secunia.com/advisories/21196 · Aviso do Fabricante
• http://securityreason.com/securityalert/1288 · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2006-3879 · Nota
• http://vupen.com/english/advisories/2006/2967 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-3879 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3879 · Nota de Segurança
• http://securityfocus.com/archive/1/441006/100/0/threaded · Nota
• https://errata.altlinux.org/ALT-PU-2014-2127 · Aviso do Fabricante