PT-2008-6944 · Gnu · Libaudio-Dev+1

Published 1970-01-01 · Updated 2017-08-08 · CVE-2008-5030

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libcdaudio versions prior to 0.99.12-r1 libcdaudio-dev versions (affected versions not specified)

Description The issue involves multiple vulnerabilities in the libcdaudio package that can lead to breaches in confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, a heap-based buffer overflow in the cddb read disc data function in cddb.c in libcdaudio 0.99.12p2 allows remote CDDB servers to execute arbitrary code via long CDDB data.

Recommendations For versions prior to 0.99.12-r1, update to version 0.99.12-r1 or later to resolve the issue. As a temporary workaround, consider restricting access to the cddb read disc data function in cddb.c until a patch is available. Avoid using long CDDB data in the affected API endpoint until the issue is resolved. At the moment, there is no information about additional mitigation measures for libcdaudio-dev.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-03465

BDU:2015-03466

BDU:2015-09364

CVE-2008-5030

DSA-1665-1

Affected Products

Libcdaudio

Libaudio-Dev

References · 24

• http://security.gentoo.org/glsa/glsa-200903-31.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:233 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-5030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5030 · Security Note
• https://bdu.fstec.ru/vul/2015-03465 · Security Note
• https://bdu.fstec.ru/vul/2015-03466 · Security Note
• https://osv.dev/vulnerability/CVE-2008-5030 · Vendor Advisory
• http://vupen.com/english/advisories/2008/3132 · Vendor Advisory
• http://debian.org/security/2008/dsa-1665 · Vendor Advisory
• http://secunia.com/advisories/32678 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5030 · Security Note
• https://bdu.fstec.ru/vul/2015-09364 · Security Note
• http://secunia.com/advisories/34353 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5030 · Vendor Advisory