Executive Summary

NameCVE-2009-0135First vendor Publication2009-01-16
VendorCveLast vendor Modification2011-03-07

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score9.3Attack RangeNetwork
Cvss Impact Score10Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Security Protection

ImpactsProvides administrator access : Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.


Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0135

CWE : Common Weakness Enumeration

100 %CWE-119Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration


OpenVAS Exploits

2009-12-14Name : Mandriva Security Advisory MDVSA-2009:030-1 (amarok)
File : nvt/mdksa_2009_030_1.nasl
2009-03-31Name : Gentoo Security Advisory GLSA 200903-34 (amarok)
File : nvt/glsa_200903_34.nasl
2009-03-31Name : FreeBSD Ports: amarok
File : nvt/freebsd_amarok.nasl
2009-03-20Name : Ubuntu USN-735-1 (gst-plugins-base0.10)
File : nvt/ubuntu_735_1.nasl
2009-03-20Name : Ubuntu USN-736-1 (gst-plugins-good0.10)
File : nvt/ubuntu_736_1.nasl
2009-03-20Name : Ubuntu USN-737-1 (libsoup)
File : nvt/ubuntu_737_1.nasl
2009-03-20Name : Ubuntu USN-739-1 (amarok)
File : nvt/ubuntu_739_1.nasl
2009-02-02Name : Ubuntu USN-710-1 (xine-lib)
File : nvt/ubuntu_710_1.nasl
2009-02-02Name : Ubuntu USN-711-1 (ktorrent)
File : nvt/ubuntu_711_1.nasl
2009-02-02Name : Ubuntu USN-712-1 (vim)
File : nvt/ubuntu_712_1.nasl
2009-02-02Name : SuSE Security Summary SUSE-SR:2009:003
File : nvt/suse_sr_2009_003.nasl
2009-02-02Name : Mandrake Security Advisory MDVSA-2009:030 (amarok)
File : nvt/mdksa_2009_030.nasl
2009-01-26Name : Fedora Core 9 FEDORA-2009-0715 (amarok)
File : nvt/fcore_2009_0715.nasl
2009-01-22Name : Amarok Player Multiple Vulnerabilities
File : nvt/secpod_amarok_mult_vuln_lin.nasl
2009-01-20Name : Fedora Core 10 FEDORA-2009-0550 (amarok)
File : nvt/fcore_2009_0550.nasl
2009-01-20Name : Debian Security Advisory DSA 1706-1 (amarok)
File : nvt/deb_1706_1.nasl

Open Source Vulnerability Database (OSVDB)

53459Amarok metadata/audible/audibletag.cpp Audible::Tag::readTag Function Audible...

Nessus® Vulnerability Scanner

2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_amarok-5931.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote openSUSE host is missing a security update.
File : suse_11_0_amarok-090119.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote openSUSE host is missing a security update.
File : suse_11_1_amarok-090119.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-030.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-739-1.nasl - Type : ACT_GATHER_INFO
2009-03-24Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_6bb6188c17b211deae4d0030843d3802.nasl - Type : ACT_GATHER_INFO
2009-03-22Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200903-34.nasl - Type : ACT_GATHER_INFO
2009-01-29Name : The remote openSUSE host is missing a security update.
File : suse_amarok-5932.nasl - Type : ACT_GATHER_INFO
2009-01-22Name : The remote Fedora host is missing a security update.
File : fedora_2009-0715.nasl - Type : ACT_GATHER_INFO
2009-01-16Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1706.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

BID http://www.securityfocus.com/bid/33210
BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/499984/100/0/threaded
CONFIRM http://amarok.kde.org/en/releases/
DEBIAN http://www.debian.org/security/2009/dsa-1706
FEDORA https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708...
GENTOO http://security.gentoo.org/glsa/glsa-200903-34.xml
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2009:030
MISC http://trapkit.de/advisories/TKADV2009-002.txt
MLIST http://openwall.com/lists/oss-security/2009/01/14/2
SECTRACK http://www.securitytracker.com/id?1021558
SREASON http://securityreason.com/securityalert/4915
SUSE http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
UBUNTU http://www.ubuntu.com/usn/USN-739-1
VUPEN http://www.vupen.com/english/advisories/2009/0100

Alert History

If you want to see full details history, please login or register.
2016-04-26 18:33:32
  • Multiple Updates
2014-02-17 10:48:20
  • Multiple Updates
2013-05-10 23:42:05
  • Multiple Updates