CVE-2004-0982: Buffer Overflow
First published: Fri Nov 19 2004(Updated: )
Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users to execute arbitrary code via an mp3 file that contains a long string before the @ (at sign) in a URL.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| mpg123 | =0.59r | |
| mpg123 | =pre0.59s |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/11468
- http://www.debian.org/security/2004/dsa-578
- http://www.barrossecurity.com/advisories/mpg123_getauthfromurl_bof_advisory.txt
- http://www.gentoo.org/security/en/glsa/glsa-200410-27.xml
- http://www.osvdb.org/11023
- http://securitytracker.com/id?1011832
- http://secunia.com/advisories/12908
- http://marc.info/?l=bugtraq&m=109834486312407&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17574
Frequently Asked Questions
What is the severity of CVE-2004-0982?
CVE-2004-0982 is a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2004-0982?
To fix CVE-2004-0982, users should upgrade to a newer version of mpg123 that is not affected by this vulnerability.
What systems are affected by CVE-2004-0982?
CVE-2004-0982 affects mpg123 versions pre0.59s and 0.59r.
Can CVE-2004-0982 be exploited remotely?
Yes, CVE-2004-0982 can be exploited by remote attackers through specially crafted MP3 files.
What kind of attacks can CVE-2004-0982 enable?
CVE-2004-0982 can enable attackers to execute arbitrary code on the vulnerable system.
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-historical
- vendor/mpg123
- product/mpg123
- canonical/mpg123 mpg123
- agent/software-canonical-lookup-request
- collector/nvd-index
- canonical/mpg123
- version/mpg123/0.59r
- version/mpg123/pre0.59s