Vulnerabilities > CVE-2008-1420 - Numeric Errors vulnerability in Xiph.Org Libvorbis
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
OS | 8 | |
Application | 6 |
Common Weakness Enumeration (CWE)
Nessus
NASL family SuSE Local Security Checks NASL id SUSE9_12159.NASL description Several security problems were fixed in libvorbis : - Division by zero. (CVE-2008-1419) - integer overflow. (CVE-2008-1420) - integer overflow. (CVE-2008-1423) last seen 2020-06-01 modified 2020-06-02 plugin id 41213 published 2009-09-24 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/41213 title SuSE9 Security Update : libvorbis (YOU Patch Number 12159) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The text description of this plugin is (C) Novell, Inc. # include("compat.inc"); if (description) { script_id(41213); script_version("1.8"); script_cvs_date("Date: 2019/10/25 13:36:31"); script_cve_id("CVE-2008-1419", "CVE-2008-1420", "CVE-2008-1423"); script_name(english:"SuSE9 Security Update : libvorbis (YOU Patch Number 12159)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 9 host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "Several security problems were fixed in libvorbis : - Division by zero. (CVE-2008-1419) - integer overflow. (CVE-2008-1420) - integer overflow. (CVE-2008-1423)" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-1419.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-1420.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-1423.html" ); script_set_attribute(attribute:"solution", value:"Apply YOU patch number 12159."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_cwe_id(20, 189); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux"); script_set_attribute(attribute:"patch_publication_date", value:"2008/05/21"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/24"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled."); if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE."); if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages."); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) exit(1, "Failed to determine the architecture type."); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 9 on the '"+cpu+"' architecture have not been implemented."); flag = 0; if (rpm_check(release:"SUSE9", reference:"libvorbis-1.0.1-56.8")) flag++; if (rpm_check(release:"SUSE9", reference:"libvorbis-devel-1.0.1-56.8")) flag++; if (rpm_check(release:"SUSE9", cpu:"x86_64", reference:"libvorbis-32bit-9-200805201623")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else exit(0, "The host is not affected.");
NASL family Fedora Local Security Checks NASL id FEDORA_2008-3910.NASL description Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 32342 published 2008-05-16 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/32342 title Fedora 9 : libvorbis-1.2.0-4.fc9 (2008-3910) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2008-3910. # include("compat.inc"); if (description) { script_id(32342); script_version ("1.15"); script_cvs_date("Date: 2019/08/02 13:32:27"); script_cve_id("CVE-2008-1419", "CVE-2008-1420", "CVE-2008-1423"); script_bugtraq_id(29206); script_xref(name:"FEDORA", value:"2008-3910"); script_name(english:"Fedora 9 : libvorbis-1.2.0-4.fc9 (2008-3910)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=440700" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=440706" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=440709" ); # https://lists.fedoraproject.org/pipermail/package-announce/2008-May/009908.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?d3370d4e" ); script_set_attribute( attribute:"solution", value:"Update the affected libvorbis package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(20, 189); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libvorbis"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:9"); script_set_attribute(attribute:"patch_publication_date", value:"2008/05/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/05/16"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^9([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 9.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC9", reference:"libvorbis-1.2.0-4.fc9")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libvorbis"); }
NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2008-0270.NASL description Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format. Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. Users of libvorbis are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 32326 published 2008-05-16 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/32326 title CentOS 3 / 4 / 5 : libvorbis (CESA-2008:0270) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2008:0270 and # CentOS Errata and Security Advisory 2008:0270 respectively. # include("compat.inc"); if (description) { script_id(32326); script_version("1.19"); script_cvs_date("Date: 2019/10/25 13:36:04"); script_cve_id("CVE-2008-1419", "CVE-2008-1420", "CVE-2008-1423"); script_bugtraq_id(29206); script_xref(name:"RHSA", value:"2008:0270"); script_name(english:"CentOS 3 / 4 / 5 : libvorbis (CESA-2008:0270)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote CentOS host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format. Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. Users of libvorbis are advised to upgrade to these updated packages, which contain backported patches to resolve these issues." ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014898.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?c0ddfbdb" ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014899.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?b6ff27a7" ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014900.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?0ef44d9e" ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014901.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?c4d76914" ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014906.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?a84fa5d4" ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014908.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?deb53d9f" ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014914.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?5b257c95" ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014915.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?f0d1611b" ); script_set_attribute( attribute:"solution", value:"Update the affected libvorbis packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(20, 189); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libvorbis"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libvorbis-devel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:3"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:4"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5"); script_set_attribute(attribute:"vuln_publication_date", value:"2008/05/16"); script_set_attribute(attribute:"patch_publication_date", value:"2008/05/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/05/16"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"CentOS Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/CentOS/release"); if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS"); os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS"); os_ver = os_ver[1]; if (! preg(pattern:"^(3|4|5)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 3.x / 4.x / 5.x", "CentOS " + os_ver); if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu); flag = 0; if (rpm_check(release:"CentOS-3", reference:"libvorbis-1.0-10.el3")) flag++; if (rpm_check(release:"CentOS-3", reference:"libvorbis-devel-1.0-10.el3")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"libvorbis-1.1.0-3.el4_6.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"ia64", reference:"libvorbis-1.1.0-3.c4.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"libvorbis-1.1.0-3.el4_6.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"libvorbis-devel-1.1.0-3.el4_6.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"ia64", reference:"libvorbis-devel-1.1.0-3.c4.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"libvorbis-devel-1.1.0-3.el4_6.1")) flag++; if (rpm_check(release:"CentOS-5", reference:"libvorbis-1.1.2-3.el5_1.2")) flag++; if (rpm_check(release:"CentOS-5", reference:"libvorbis-devel-1.1.2-3.el5_1.2")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libvorbis / libvorbis-devel"); }
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_94EDFF42D93D11DEA4340211D880E350.NASL description The Ubuntu security team reports : It was discovered that libvorbis did not correctly handle certain malformed vorbis files. If a user were tricked into opening a specially crafted vorbis file with an application that uses libvorbis, an attacker could cause a denial of service or possibly execute arbitrary code with the user last seen 2020-06-01 modified 2020-06-02 plugin id 42886 published 2009-11-25 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42886 title FreeBSD : libvorbis -- multiple vulnerabilities (94edff42-d93d-11de-a434-0211d880e350) NASL family Fedora Local Security Checks NASL id FEDORA_2008-3934.NASL description Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 32345 published 2008-05-16 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/32345 title Fedora 8 : libvorbis-1.2.0-2.fc8 (2008-3934) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2008-102.NASL description Will Drewry of the Google Security Team reported several vulnerabilities in how libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it would cause an application linked to libvorbis to crash or possibly execute arbitrary code when opened (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423). The updated packages have been patched to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 36438 published 2009-04-23 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/36438 title Mandriva Linux Security Advisory : libvorbis (MDVSA-2008:102) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1591.NASL description Several local (remote) vulnerabilities have been discovered in libvorbis, a library for the Vorbis general-purpose compressed audio codec. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-1419 libvorbis does not properly handle a zero value which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow. - CVE-2008-1420 Integer overflow in libvorbis allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow. - CVE-2008-1423 Integer overflow in libvorbis allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file which triggers a heap overflow. last seen 2020-06-01 modified 2020-06-02 plugin id 33077 published 2008-06-04 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/33077 title Debian DSA-1591-1 : libvorbis - several vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-682-1.NASL description It was discovered that libvorbis did not correctly handle certain malformed sound files. If a user were tricked into opening a specially crafted sound file with an application that uses libvorbis, an attacker could execute arbitrary code with the user last seen 2020-06-01 modified 2020-06-02 plugin id 37207 published 2009-04-23 reporter Ubuntu Security Notice (C) 2008-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/37207 title Ubuntu 6.06 LTS / 7.10 / 8.04 LTS : libvorbis vulnerabilities (USN-682-1) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0270.NASL description Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format. Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. Users of libvorbis are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 32355 published 2008-05-16 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/32355 title RHEL 3 / 4 / 5 : libvorbis (RHSA-2008:0270) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_3DAC84C9BCE141999784D68AF1EB7B2E.NASL description The RedHat Project reports : Will Drewry of the Google Security Team reported multiple issues in OGG Vorbis and Tremor libraries, that could cause application using those libraries to crash (NULL pointer dereference or divide by zero), enter an infinite loop or cause heap overflow caused by integer overflow. last seen 2020-06-01 modified 2020-06-02 plugin id 85639 published 2015-08-26 reporter This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/85639 title FreeBSD : libtremor -- multiple vulnerabilities (3dac84c9-bce1-4199-9784-d68af1eb7b2e) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0271.NASL description Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having important security impact by the Red Hat Security Response Team. The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format. Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423, CVE-2008-2009) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. Users of libvorbis are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 32356 published 2008-05-16 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/32356 title RHEL 2.1 : libvorbis (RHSA-2008:0271) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-825-1.NASL description It was discovered that libvorbis did not correctly handle certain malformed ogg files. If a user were tricked into opening a specially crafted ogg file with an application that uses libvorbis, an attacker could execute arbitrary code with the user last seen 2020-06-01 modified 2020-06-02 plugin id 40769 published 2009-08-25 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40769 title Ubuntu 8.04 LTS / 8.10 / 9.04 : libvorbis vulnerability (USN-825-1) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2008-0270.NASL description From Red Hat Security Advisory 2008:0270 : Updated libvorbis packages that fix various security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format. Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. Users of libvorbis are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67690 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67690 title Oracle Linux 3 / 4 / 5 : libvorbis (ELSA-2008-0270) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_F5A76FAF244C11DDB1430211D880E350.NASL description Red Hat reports : Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted [Vorbis] audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. last seen 2020-06-01 modified 2020-06-02 plugin id 32388 published 2008-05-20 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/32388 title FreeBSD : libvorbis -- various security issues (f5a76faf-244c-11dd-b143-0211d880e350) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200806-09.NASL description The remote host is affected by the vulnerability described in GLSA-200806-09 (libvorbis: Multiple vulnerabilities) Will Drewry of the Google Security Team reported multiple vulnerabilities in libvorbis: A zero value for last seen 2020-06-01 modified 2020-06-02 plugin id 33245 published 2008-06-24 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/33245 title GLSA-200806-09 : libvorbis: Multiple vulnerabilities NASL family Scientific Linux Local Security Checks NASL id SL_20080514_LIBVORBIS_ON_SL3_X.NASL description Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. last seen 2020-06-01 modified 2020-06-02 plugin id 60399 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60399 title Scientific Linux Security Update : libvorbis on SL3.x, SL4.x, SL5.x i386/x86_64 NASL family SuSE Local Security Checks NASL id SUSE_LIBVORBIS-5258.NASL description Several security problems were fixed in libvorbis : - CVE-2008-1419 - Division by zero - CVE-2008-1420 - integer overflow - CVE-2008-1423 - integer overflow last seen 2020-06-01 modified 2020-06-02 plugin id 32473 published 2008-05-29 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/32473 title openSUSE 10 Security Update : libvorbis (libvorbis-5258) NASL family SuSE Local Security Checks NASL id SUSE_LIBVORBIS-5259.NASL description Several security problems were fixed in libvorbis : - Division by zero. (CVE-2008-1419) - integer overflow. (CVE-2008-1420) - integer overflow. (CVE-2008-1423) last seen 2020-06-01 modified 2020-06-02 plugin id 32474 published 2008-05-29 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/32474 title SuSE 10 Security Update : libvorbis (ZYPP Patch Number 5259) NASL family Fedora Local Security Checks NASL id FEDORA_2008-3898.NASL description Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened. (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423) Moreover, additional OGG file sanity-checks have been added to prevent possible exploitation of similar issues in the future. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 32339 published 2008-05-16 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/32339 title Fedora 7 : libvorbis-1.1.2-4.fc7 (2008-3898)
Oval
accepted | 2013-04-29T04:19:48.775-04:00 | ||||||||||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||||||||||||||
description | Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow. | ||||||||||||||||||||||||||||||||
family | unix | ||||||||||||||||||||||||||||||||
id | oval:org.mitre.oval:def:9500 | ||||||||||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||||||||||
submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||||||||||||||
title | Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow. | ||||||||||||||||||||||||||||||||
version | 27 |
Redhat
advisories |
| ||||||||
rpms |
|
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 29206 CVE(CAN) ID: CVE-2008-1419,CVE-2008-1420,CVE-2008-1423 libvorbis是开源的音频音乐编码解码函数库。 libvorbis在处理畸形格式的OGG文件时存在漏洞,远程攻击者可能利用此漏洞控制用户系统。 如果特制的OGG文件包含有codebook维度为0的话,打开该文件就会导致使用libvorbis库的应用程序崩溃、出现死循环或堆溢出。 如果使用libvorbis库的应用程序打开了特制的OGG文件的话,在处理residue分区值和计算quantvals及quantlist所需空间时可能会出现整数溢出,最终会导致堆溢出。 Xiph.org Libvorbis 1.2 RedHat ------ RedHat已经为此发布了一个安全公告(RHSA-2008:0270-01)以及相应补丁: RHSA-2008:0270-01:Important: libvorbis security update 链接:<a href=https://www.redhat.com/support/errata/RHSA-2008-0270.html target=_blank>https://www.redhat.com/support/errata/RHSA-2008-0270.html</a> Xiph.org -------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=https://trac.xiph.org/changeset/14602 target=_blank>https://trac.xiph.org/changeset/14602</a> <a href=https://trac.xiph.org/changeset/14598 target=_blank>https://trac.xiph.org/changeset/14598</a> <a href=https://trac.xiph.org/changeset/14600 target=_blank>https://trac.xiph.org/changeset/14600</a> <a href=https://trac.xiph.org/changeset/14604 target=_blank>https://trac.xiph.org/changeset/14604</a> |
id | SSV:3300 |
last seen | 2017-11-19 |
modified | 2008-05-17 |
published | 2008-05-17 |
reporter | Root |
title | libvorbis多个缓冲区溢出漏洞 |
References
- http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html
- http://secunia.com/advisories/30234
- http://secunia.com/advisories/30237
- http://secunia.com/advisories/30247
- http://secunia.com/advisories/30259
- http://secunia.com/advisories/30479
- http://secunia.com/advisories/30581
- http://secunia.com/advisories/30820
- http://secunia.com/advisories/32946
- http://secunia.com/advisories/36463
- http://security.gentoo.org/glsa/glsa-200806-09.xml
- http://www.debian.org/security/2008/dsa-1591
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:102
- http://www.redhat.com/support/errata/RHSA-2008-0270.html
- http://www.redhat.com/support/errata/RHSA-2008-0271.html
- http://www.securityfocus.com/bid/29206
- http://www.securitytracker.com/id?1020029
- http://www.ubuntu.com/usn/USN-682-1
- http://www.vupen.com/english/advisories/2008/1510/references
- https://bugzilla.redhat.com/show_bug.cgi?id=440706
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42402
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9500
- https://usn.ubuntu.com/825-1/
- https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00243.html
- https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00247.html
- https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00256.html