Executive Summary

Informations
Name CVE-2013-4234 First vendor Publication 2013-09-16
Vendor Cve Last vendor Modification 2016-12-31

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmodplug 0.8.8.4 and earlier allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted ABC.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4234

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18911
 
Oval ID: oval:org.mitre.oval:def:18911
Title: DSA-2751-1 libmodplug - several
Description: Several vulnerabilities have been discovered in libmodplug, a library for mod music based on ModPlug, that might allow arbitrary code execution when processing specially-crafted ABC files through applications using the library, such as media players.
Family: unix Class: patch
Reference(s): DSA-2751-1
CVE-2013-4233
CVE-2013-4234
 Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
 Product(s): libmodplug
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 9
Os 2

Snort® IPS/IDS

Date Description
2016-05-19 ABC file instruction field parsing exploitation attempt
RuleID : 38572 - Revision : 2 - Type : FILE-OTHER
2016-05-19 ABC file instruction field parsing exploitation attempt
RuleID : 38571 - Revision : 2 - Type : FILE-OTHER
2016-05-19 ABC file instruction field parsing exploitation attempt
RuleID : 38570 - Revision : 2 - Type : FILE-OTHER
2016-05-19 ABC file instruction field parsing exploitation attempt
RuleID : 38569 - Revision : 2 - Type : FILE-OTHER

Nessus® Vulnerability Scanner

Date Description
2014-08-17 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201408-07.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-820.nasl - Type : ACT_GATHER_INFO
2014-03-22 Name : The remote Fedora host is missing a security update.
File : fedora_2014-3791.nasl - Type : ACT_GATHER_INFO
2014-03-22 Name : The remote Fedora host is missing a security update.
File : fedora_2014-3795.nasl - Type : ACT_GATHER_INFO
2013-09-14 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-232.nasl - Type : ACT_GATHER_INFO
2013-09-05 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2751.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/61714
DEBIAN http://www.debian.org/security/2013/dsa-2751
MISC http://blog.scrt.ch/2013/07/24/vlc-abc-parsing-seems-to-be-a-ctf-challenge/
MLIST http://www.openwall.com/lists/oss-security/2013/08/10/3
SECUNIA http://secunia.com/advisories/54388
http://secunia.com/advisories/54695

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
Date Informations
2020-05-23 00:37:55
  • Multiple Updates
2016-12-31 09:24:18
  • Multiple Updates
2016-04-26 23:31:25
  • Multiple Updates
2014-08-18 13:26:07
  • Multiple Updates
2014-06-14 13:36:00
  • Multiple Updates
2014-03-23 13:21:23
  • Multiple Updates
2014-02-17 11:21:51
  • Multiple Updates
2013-09-26 17:20:03
  • Multiple Updates
2013-09-17 21:21:17
  • Multiple Updates
2013-09-17 00:25:28
  • First insertion