Executive Summary

Informations
NameCVE-2009-0135First vendor Publication2009-01-16
VendorCveLast vendor Modification2011-03-07

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score9.3Attack RangeNetwork
Cvss Impact Score10Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Security Protection

ImpactsProvides administrator access : Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.

Detail

Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0135

CWE : Common Weakness Enumeration

idName
CWE-119Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

TypeDescriptionCount
Application3

OpenVAS Exploits

DateDescription
2009-12-14Name : Mandriva Security Advisory MDVSA-2009:030-1 (amarok)
File : nvt/mdksa_2009_030_1.nasl
2009-03-31Name : Gentoo Security Advisory GLSA 200903-34 (amarok)
File : nvt/glsa_200903_34.nasl
2009-03-31Name : FreeBSD Ports: amarok
File : nvt/freebsd_amarok.nasl
2009-03-20Name : Ubuntu USN-735-1 (gst-plugins-base0.10)
File : nvt/ubuntu_735_1.nasl
2009-03-20Name : Ubuntu USN-736-1 (gst-plugins-good0.10)
File : nvt/ubuntu_736_1.nasl
2009-03-20Name : Ubuntu USN-737-1 (libsoup)
File : nvt/ubuntu_737_1.nasl
2009-03-20Name : Ubuntu USN-739-1 (amarok)
File : nvt/ubuntu_739_1.nasl
2009-02-02Name : Ubuntu USN-710-1 (xine-lib)
File : nvt/ubuntu_710_1.nasl
2009-02-02Name : Ubuntu USN-711-1 (ktorrent)
File : nvt/ubuntu_711_1.nasl
2009-02-02Name : Ubuntu USN-712-1 (vim)
File : nvt/ubuntu_712_1.nasl
2009-02-02Name : SuSE Security Summary SUSE-SR:2009:003
File : nvt/suse_sr_2009_003.nasl
2009-02-02Name : Mandrake Security Advisory MDVSA-2009:030 (amarok)
File : nvt/mdksa_2009_030.nasl
2009-01-26Name : Fedora Core 9 FEDORA-2009-0715 (amarok)
File : nvt/fcore_2009_0715.nasl
2009-01-22Name : Amarok Player Multiple Vulnerabilities
File : nvt/secpod_amarok_mult_vuln_lin.nasl
2009-01-20Name : Fedora Core 10 FEDORA-2009-0550 (amarok)
File : nvt/fcore_2009_0550.nasl
2009-01-20Name : Debian Security Advisory DSA 1706-1 (amarok)
File : nvt/deb_1706_1.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
53459Amarok metadata/audible/audibletag.cpp Audible::Tag::readTag Function Audible...

Nessus® Vulnerability Scanner

DateDescription
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_amarok-5931.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote SuSE system is missing a security patch for amarok
File : suse_11_0_amarok-090119.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote SuSE system is missing a security patch for amarok
File : suse_11_1_amarok-090119.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-030.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-739-1.nasl - Type : ACT_GATHER_INFO
2009-03-24Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_6bb6188c17b211deae4d0030843d3802.nasl - Type : ACT_GATHER_INFO
2009-03-22Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200903-34.nasl - Type : ACT_GATHER_INFO
2009-01-29Name : The remote SuSE system is missing the security patch amarok-5932
File : suse_amarok-5932.nasl - Type : ACT_GATHER_INFO
2009-01-22Name : The remote Fedora host is missing a security update.
File : fedora_2009-0715.nasl - Type : ACT_GATHER_INFO
2009-01-16Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1706.nasl - Type : ACT_GATHER_INFO

Internal Sources (Detail)

SourceUrl
BIDhttp://www.securityfocus.com/bid/33210
BUGTRAQhttp://www.securityfocus.com/archive/1/archive/1/499984/100/0/threaded
CONFIRMhttp://amarok.kde.org/en/releases/2.0.1.1
http://bugs.gentoo.org/show_bug.cgi?id=254896
http://websvn.kde.org/?view=rev&revision=908391
http://websvn.kde.org/?view=rev&revision=908401
http://websvn.kde.org/?view=rev&revision=908415
https://bugzilla.redhat.com/show_bug.cgi?id=479560
https://bugzilla.redhat.com/show_bug.cgi?id=479946
DEBIANhttp://www.debian.org/security/2009/dsa-1706
FEDORAhttps://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708...
GENTOOhttp://security.gentoo.org/glsa/glsa-200903-34.xml
MANDRIVAhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:030
MISChttp://trapkit.de/advisories/TKADV2009-002.txt
MLISThttp://openwall.com/lists/oss-security/2009/01/14/2
SECTRACKhttp://www.securitytracker.com/id?1021558
SECUNIAhttp://secunia.com/advisories/33505
http://secunia.com/advisories/33522
http://secunia.com/advisories/33640
http://secunia.com/advisories/33819
http://secunia.com/advisories/34315
http://secunia.com/advisories/34407
SREASONhttp://securityreason.com/securityalert/4915
SUSEhttp://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
UBUNTUhttp://www.ubuntu.com/usn/USN-739-1
VUPENhttp://www.vupen.com/english/advisories/2009/0100

Alert History

If you want to see full details history, please login or register.
0
1
DateInformations
2014-02-17 10:48:20
  • Multiple Updates
2013-05-10 23:42:05
  • Multiple Updates