PT-2007-7500 · Id3Lib · Id3Lib+2

Published 1970-01-01 · Updated 2024-06-15 · CVE-2007-4460

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions id3lib versions prior to 3.8.3-r6 libid3-3.8.3-dev (affected versions not specified) libid3-3.8.3 (affected versions not specified)

Description The issue allows local users to exploit the vulnerability, potentially leading to a breach of confidentiality, integrity, and availability of protected information. The exploitation can be carried out locally. Specifically, the RenderV2ToFile function in tag file.cpp is vulnerable to a symlink attack on a temporary file, allowing local users to overwrite arbitrary files.

Recommendations For id3lib versions prior to 3.8.3-r6, update to version 3.8.3-r6 or later to resolve the issue. For libid3-3.8.3-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libid3-3.8.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-02973

BDU:2015-02974

BDU:2015-09597

CVE-2007-4460

DSA-1365-1

DSA-1365-2

DSA-1365-3

OPENSUSE-SU-2024:10082-1

Affected Products

Id3Lib

Libid3-3.8.3

Libid3-3.8.3-Dev

References · 24

• 🔥 http://securityfocus.com/bid/25372 · Exploit
• https://bdu.fstec.ru/vul/2015-02974 · Security Note
• https://bdu.fstec.ru/vul/2015-02973 · Security Note
• http://security.gentoo.org/glsa/glsa-200709-08.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09597 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2007:180 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-4460 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4460 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-4460 · Security Note
• http://debian.org/security/2007/dsa-1365 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_19_sr.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4460 · Vendor Advisory
• http://secunia.com/advisories/26536 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10082-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-4460 · Vendor Advisory