Executive Summary
| Summary | |
|---|---|
| Title | New freeam packages fix arbitrary code execution |
| Informations | |||
|---|---|---|---|
| Name | DSA-587 | First vendor Publication | 2004-11-08 |
| Vendor | Debian | Last vendor Modification | 2004-11-08 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Luigi Auriemma discovered a buffer overflow condition in the playlist module of freeamp which could lead to arbitrary code execution. Recent versions of freeamp were renamed into zinf. For the stable distribution (woody) this problem has been fixed in version 2.1.1.0-4woody2. For the unstable distribution (sid) this problem does not exist in the zinf packageas the code in question was rewritten. We recommend that you upgrade your freeamp packages. |
Original Source
| Url : http://www.debian.org/security/2004/dsa-587 |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-04 | Name : FreeBSD Ports: zinf File : nvt/freebsd_zinf.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 587-1 (freeamp) File : nvt/deb_587_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 10416 | Zinf Playlist Manager .pls File Overflow A buffer overflow exists in Zinf 2.2.1 and below. The Zinf player fails to check buffer lengths resulting in a stack overflow. With a specially crafted playlist file, a context-dependent attacker can execute arbitrary code. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2004-11-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-587.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:33:34 |
|
