PT-2006-1073 · Musicbrainz · Libmusicbrainz
Luigi Auriemma
·
Published
2006-08-17
·
Updated
2018-10-17
·
CVE-2006-4197
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
libmusicbrainz versions prior to 2.1.4
Description:
The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely, potentially leading to a denial of service or the execution of arbitrary code. This is achieved through buffer overflows, specifically by sending a long Location header via an HTTP server, which triggers an overflow in the
MBHttp::Download function, or by using a long URL in RDF data, which can cause overflows in multiple functions.Recommendations:
For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the
MBHttp::Download function and limiting the use of long URLs in RDF data to minimize the risk of exploitation.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Libmusicbrainz