PT-2006-7150 · Nullsoft · Winamp Ipod Plugin

Luigi Auriemma · Publicado 2006-12-14 · Atualizado 2017-07-29 · CVE-2006-6547

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Winamp iPod Plugin (ml ipod) versions 2.00 p19 and earlier

Description The issue is related to a buffer overflow in the readAA function, which can be triggered by a long tag in an audible.com audiobook (aa) file. This can cause a denial of service, resulting in an application crash, or potentially allow the execution of arbitrary code.

Recommendations For versions 2.00 p19 and earlier, consider disabling the readAA function in read aa.cpp to prevent potential exploitation until a fix is available. Restrict access to aa files from untrusted sources to minimize the risk of a denial of service or code execution.

Correção

Identificadores relacionados

CVE-2006-6547

Produtos afetados

Winamp Ipod Plugin

Referências · 9

• http://aluigi.altervista.org/adv/mlipodbof-adv.txt · Aviso do Fabricante
• http://secunia.com/advisories/23354 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30866 · Nota
• http://mlipod.cvs.sourceforge.net/mlipod/ml_ipod/read_aa.cpp?r1=1.3.6.1&r2=1.3.6.2 · Nota
• http://securityfocus.com/bid/21569 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6547 · Nota de Segurança
• http://vupen.com/english/advisories/2006/4986 · Nota
• http://osvdb.org/32266 · Nota
• http://mlipod.cvs.sourceforge.net/mlipod/ml_ipod/read_aa.cpp · Nota