ModPlug: User-assisted execution of arbitrary code

1.  Gentoo Linux Security Advisory

Version Information

Related bugreports: #362503, #379557

Synopsis

Multiple vulnerabilities in ModPlug could result in execution of arbitrary code or Denial of Service.

2.  Impact Information

Background

ModPlug is a library for playing MOD-like music.

Description

Multiple vulnerabilities have been found in ModPlug:

• The ReadS3M method in load_s3m.cpp fails to validate user-supplied information, which could cause a stack-based buffer overflow (CVE-2011-1574).
• The "CSoundFile::ReadWav()" function in load_wav.cpp contains an integer overflow which could cause a heap-based buffer overflow (CVE-2011-2911).
• The "CSoundFile::ReadS3M()" function in load_s3m.cpp contains multiple boundary errors which could cause a stack-based buffer overflow (CVE-2011-2912).
• The "CSoundFile::ReadAMS()" function in load_ams.cpp contains an off-by-one error which could cause memory corruption (CVE-2011-2913).
• The "CSoundFile::ReadDSM()" function in load_dms.cpp contains an off-by-one error which could cause memory corruption (CVE-2011-2914).
• The "CSoundFile::ReadAMS2()" function in load_ams.cpp contains an off-by-one error which could cause memory corruption (CVE-2011-2915).

Impact

A remote attacker could entice a user to open a specially crafted media file, possibly resulting in execution of arbitrary code, or a Denial of Service condition.

3.  Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All ModPlug users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=media-libs/libmodplug-0.8.8.4"

NOTE: This is a legacy GLSA. Updates for all affected architectures are available since August 27, 2011. It is likely that your system is already no longer affected by this issue.

4.  References

• CVE-2011-1574
• CVE-2011-2911
• CVE-2011-2912
• CVE-2011-2913
• CVE-2011-2914
• CVE-2011-2915