CVE-2007-3106: Medium severity rPath rPath Linux vulnerability
Chris Montgomery has informed us of a bug found in libvorbis. The patch is in revision 13160 from http://svn.xiph.org/trunk/vorbis (svn diff -r 13159:13160 http://svn.xiph.org/trunk/vorbis)
I'm calling this bug an "array boundary condition flaw". It's the best definition I could find that matched up with something MITRE uses. The issue in question is related to the usage of a function pointer table. Here is an example:
mappingP[ci->maptype[i]]->freeinfo(ci->mapparam[i]);
What happens is the value of 'ci->maptype[i]' can be an attacker controlled 16 bit unsigned integer. The amount of play with the that function pointer is a bit suspect I admit, but I suspect it's still exploitable (some peer review from someone better at this sort of thing would be helpful).
The code in question is called when libvorbis starts to clean things up after receiving bad data.
Other sources
lib/info.c in libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via invalid (1) blocksize0 and (2) blocksize1 values, which trigger a "heap overwrite" in the 01inverse function in res0.c. NOTE: this issue has been RECAST so that CVE-2007-4029 handles additional vectors.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3106?
CVE-2007-3106 is a moderate severity vulnerability that affects certain versions of libvorbis.
How do I fix CVE-2007-3106?
To fix CVE-2007-3106, users should update to the latest version of libvorbis that contains the patch for this vulnerability.
Which versions of libvorbis are affected by CVE-2007-3106?
CVE-2007-3106 affects libvorbis versions up to and including 1.1.2.
Is none of Rpath Linux vulnerable to CVE-2007-3106?
Yes, Rpath Linux versions from 1.0 to 1.0.6 are reported as not vulnerable to CVE-2007-3106.
What is the nature of the vulnerability in CVE-2007-3106?
CVE-2007-3106 involves a bug in libvorbis that could lead to security issues if exploited.