oss-security - Re: CVE request: libcdaudio

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 11 Nov 2008 09:30:29 +0100
From: Thomas Biege <thomas@...e.de>
To: oss-security@...ts.openwall.com
Cc: coley@...us.mitre.org
Subject: Re: CVE request: libcdaudio

On Tue, Nov 11, 2008 at 09:22:16AM +0100, Tomas Hoger wrote:
> On Mon, 10 Nov 2008 10:20:41 -0500 (EST) "Steven M. Christey"
> <coley@...us.mitre.org> wrote:
> 
> > > we need a CVE-ID for a buffer overflow in libcdaudio.
> > > It is a remotely exploitable heap-based buffer overflow.
> > 
> > Out of curiosity, what makes it remote?
> > 
> > Use CVE-2008-5030
> 
> I guess this wording was used by Thomas as the affected code is used to
> talk to remote CDDB servers, from which you obtain list of tracks for
> your audio CD.  If remote CDDB server is untrusted / compromised, it
> can send you a crafted reply that can exploit libcdaudio flaw on your
> system.

Yes, everybody can add CDDB entries to servers like freedb.org (honestly
I didn't test it) or intercept the HTTP connection to a CDDB server.


-- 
Bye,
     Thomas
-- 
 Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
-- 
           Hamming's Motto:
           The purpose of computing is insight, not numbers.
                                -- Richard W. Hamming

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.