CVE-2009-1438: Buffer Overflow
An integer overflow flaw was found in the Amiga MED/OctaMED tracker module sound file (MED) loading routine used by the Modplug mod music file format library (libmodplug). An attacker could create a malicious MED file, that could cause an application utilizing the libmodplug library to crash, when opened by the victim.
References: http://bugs.gentoo.org/showbug.cgi?id=266913 http://www.securityfocus.com/bid/30801/info http://sourceforge.net/project/shownotes.php?releaseid=677065&groupid=1275
Modplug-xmms/libmodplug patch (fixing the vulnerability): http://modplug-xmms.cvs.sourceforge.net/viewvc/modplug-xmms/libmodplug/src/loadmed.cpp?r1=1.1&r2=1.2
Other sources
Integer overflow in the CSoundFile::ReadMed function (src/loadmed.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products, allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name, which triggers a heap-based buffer overflow, as exploited in the wild in August 2008.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1438?
CVE-2009-1438 has a medium severity rating due to the potential for denial of service attacks.
How do I fix CVE-2009-1438?
To fix CVE-2009-1438, update the libmodplug library to version 0.8.5 or later.
Which applications are affected by CVE-2009-1438?
Applications that utilize the libmodplug library version 0.8 through 0.8.4 are affected by CVE-2009-1438.
What type of flaw is CVE-2009-1438?
CVE-2009-1438 is an integer overflow flaw in the MED file loading routine.
Can CVE-2009-1438 lead to application crashes?
Yes, CVE-2009-1438 can cause applications utilizing the libmodplug library to crash when processing a malicious MED file.