PT-2006-4730 · Mikmod+1 · Mikmod Sound System+1

Luigi Auriemma · Published 2006-07-27 · Updated 2018-10-17 · CVE-2006-3879

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mikmod Sound System version 3.2.2

Description The issue is related to an integer overflow in the loadChunk function in loaders/load gt2.c, which can be triggered by a remote attacker using a specially crafted GRAOUMF TRACKER (GT2) module file. This file would contain a large comment length value (0xffffffff) in an XCOM chunk, leading to a denial of service.

Recommendations For Mikmod Sound System version 3.2.2, consider disabling the loadChunk function in loaders/load gt2.c as a temporary workaround until a patch is available. Restrict access to GT2 module files to minimize the risk of exploitation. Avoid using the loadChunk function with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2014-2127

CVE-2006-3879

Affected Products

Alt Linux

Mikmod Sound System

References · 12

• 🔥 https://exploit-db.com/exploits/2073 · Exploit
• 🔥 http://aluigi.org/poc/lmmgt2ho.zip · Exploit
• 🔥 http://securityfocus.com/bid/19134 · Exploit
• 🔥 http://aluigi.altervista.org/adv/lmmgt2ho-adv.txt · Exploit
• http://secunia.com/advisories/21196 · Vendor Advisory
• http://vupen.com/english/advisories/2006/2967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3879 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3879 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-2127 · Vendor Advisory
• http://securityreason.com/securityalert/1288 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2006-3879 · Note
• http://securityfocus.com/archive/1/441006/100/0/threaded · Note