PT-2009-2829 · Kde · Amarok

Jan Lieskovsky · Published 2009-01-16 · Updated 2018-10-11 · CVE-2009-0136

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Amarok versions 1.4.10 through 2.0.1

Description The issue concerns multiple array index errors in the Audible::Tag::readTag function, which can be exploited by remote attackers using a crafted Audible Audio (.aa) file. This can lead to a denial of service (application crash) or the execution of arbitrary code. The exploitation is possible through the nlen or vlen Tag value, resulting in an invalid pointer dereference or the writing of a 0x00 byte to an arbitrary memory location after an allocation failure.

Recommendations For Amarok versions 1.4.10 through 2.0.1, consider disabling the Audible::Tag::readTag function or restricting the use of Audible Audio (.aa) files until a patch is available. Avoid using the nlen or vlen Tag values in the affected function to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-0136

DSA-1706-1

Affected Products

Amarok

References · 30

• 🔥 http://trapkit.de/advisories/TKADV2009-002.txt · Exploit
• http://amarok.kde.org/en/releases/2.0.1.1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0136 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-0136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0136 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-0136 · Vendor Advisory
• http://debian.org/security/2009/dsa-1706 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:030 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-January/msg00708.html · Vendor Advisory
• http://ubuntu.com/usn/USN-739-1 · Vendor Advisory
• http://secunia.com/advisories/33505 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200903-34.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html · Vendor Advisory
• http://securitytracker.com/id?1021558 · Note
• http://secunia.com/advisories/34315 · Note