Bug 695420 (CVE-2011-1574) - CVE-2011-1574 libmodplug: ReadS3M stack overflow vulnerability
Summary: CVE-2011-1574 libmodplug: ReadS3M stack overflow vulnerability
Alias: CVE-2011-1574
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Whiteboard: public=20110407,reported=20110411,sou...
Keywords: Security
Depends On: 695421 695422 695455 696507
TreeView+ depends on / blocked
Reported: 2011-04-11 17:12 UTC by Vincent Danen
Modified: 2019-06-08 18:47 UTC (History)
2 users (show)

Clone Of:
Last Closed: 2015-07-29 12:36:23 UTC

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0477 normal SHIPPED_LIVE Important: gstreamer-plugins security update 2011-05-02 18:28:05 UTC

Description Vincent Danen 2011-04-11 17:12:14 UTC
A stack-based buffer overflow vulnerability was discovered [1] in the way that that libmodplug handled S3M media files.  If an attacker were able to coerce a user into opening a malicious S3M media file with an application linked to libmodplug, it could be possible to execute arbitrary code with the privileges of the user running the application.

This has been corrected upstream [2] in

[1] https://www.sec-consult.com/files/20110407-0_libmodplug_stackoverflow.txt
[2] http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=aecef259828a89bb00c2e6f78e89de7363b2237b

Comment 1 Vincent Danen 2011-04-11 17:13:20 UTC
Created libmodplug tracking bugs for this issue

Affects: fedora-all [bug 695421]
Affects: epel-all [bug 695422]

Comment 2 Vincent Danen 2011-04-11 19:13:46 UTC
This also affects gstreamer-plugins on Red Hat Enterprise Linux 4 and schismtracker in Fedora (they have embedded modplug).

Comment 3 Vincent Danen 2011-04-11 19:14:16 UTC
Created schismtracker tracking bugs for this issue

Affects: fedora-all [bug 695455]

Comment 5 Vincent Danen 2011-04-11 21:34:33 UTC
This was assigned the name CVE-2011-1574.

Comment 6 Ville Skyttä 2011-04-11 21:51:37 UTC
(In reply to comment #2)
> This also affects gstreamer-plugins on Red Hat Enterprise Linux 4 and
> schismtracker in Fedora (they have embedded modplug).

schismtracker in F-15+ doesn't seem to contain the embedded libmodplug any longer.  I haven't tried to check if their new implementation would be affected by the same issue though.

Comment 7 Vincent Danen 2011-04-12 03:02:52 UTC
I've poked around and it doesn't look like schismtracker in F15 has any similar issues (at least not that I can spot).  It does look like it can handle s3m files still, but doesn't use modplug and hasn't really copied the code that I can see (at least not the affected code).  So this would just be relevant for F13 and F14 from what I can see.

Comment 11 Ville Skyttä 2011-04-26 20:45:30 UTC
The EPEL-5 and EPEL-6 updates have sat in testing for 14 days, without any feedback.  I don't have a system to test them with myself; perhaps someone receiving these mails could help?

Comment 12 errata-xmlrpc 2011-05-02 18:28:10 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2011:0477 https://rhn.redhat.com/errata/RHSA-2011-0477.html

Note You need to log in before you can comment on or make changes to this bug.