CVE-2004-1034: Buffer Overflow

Published Nov 16, 2004

Updated

Buffer overflow in the httpopen function in Kaffeine before 0.5, whose code is also used in gxine before 0.3.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long Content-Type header for a Real Audio Media (.ram) playlist file.

Affected Software

6 affected components

Kaffeine Kaffeine Player=0.4.2

Kaffeine Kaffeine Player=0.4.3

Kaffeine Kaffeine Player=0.4.3b

Kaffeine Kaffeine Player=0.5_rc1

xine gxine=0.3

Gentoo Linux

Remediation

Patch Available

http://www.securityfocus.com/bid/11528

Event History

Nov 16, 2004

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1034?

The severity of CVE-2004-1034 is critical as it allows remote attackers to cause an application crash and potentially execute arbitrary code.

How do I fix CVE-2004-1034?

To fix CVE-2004-1034, update Kaffeine and Gxine to versions that are not vulnerable, specifically versions newer than 0.5 and 0.3.3 respectively.

Which software is affected by CVE-2004-1034?

CVE-2004-1034 affects Kaffeine versions before 0.5 and Gxine versions before 0.3.3.

What is the impact of CVE-2004-1034?

The impact of CVE-2004-1034 includes application crashes and the potential for arbitrary code execution.

Can CVE-2004-1034 be exploited remotely?

Yes, CVE-2004-1034 can be exploited remotely through a specially crafted .ram playlist file.