PT-2004-2229 · Yamt · Yamt

Published 2004-12-22 · Updated 2017-07-11 · CVE-2004-1302

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: YAMT version 0.5

Description: The issue allows remote attackers to execute arbitrary commands via an MP3 file with double quotes in the Artist tag. This is due to a problem in the id3tag sort function in id3tag.c.

Recommendations: For YAMT version 0.5, consider disabling the id3tag sort function until a patch is available to prevent exploitation. Restrict access to MP3 files with double quotes in the Artist tag to minimize the risk of arbitrary command execution.

Exploit

Fix

Related Identifiers

CVE-2004-1302

Affected Products

Yamt

References · 7

• 🔥 http://tigger.uic.edu/~jlongs2/holes/yamt.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1302 · Security Note
• http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html · Note
• http://securitytracker.com/id?1012583 · Note
• http://secunia.com/advisories/13554 · Note
• http://securityfocus.com/bid/11999 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18614 · Note