AlsaPlayer多个缓冲区溢出漏洞

漏洞信息详情

AlsaPlayer多个缓冲区溢出漏洞

• CNNVD编号：CNNVD-200608-185
• 危害等级： 中危
  
  
• CVE编号：
  CVE-2006-4089
  
• 漏洞类型：
  
  
  缓冲区溢出
  
• 发布时间：
  
  2006-08-11
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2006-08-14
  
• 厂        商：
  
  andy_lo-a-foe
• 漏洞来源：
  Luigi Auriemma is …

Andy Lo-A-Foe AlsaPlayer 0.99.76及早期版本存在多个缓冲区溢出漏洞，远程攻击者可借助以下向量触发拒绝服务攻击(应用程序崩溃)，也可能存在未知影响：(1) 网络服务器发送的一个超长Location字段，会在reader/http/http.c程序的reconnect函数中引发溢出错误；(2) 在AlsaPlayer寻找播放列表的媒体文件时，一个网络服务器发送的超长URL，会在interface/gtk/PlaylistWindow.cpp程序的new_list_item函数和CbUpdated函数中引发溢出错误；以及(3) CDDB服务器发送的一个超长响应，会在input/ccda/cdda_engine.c程序的cddb_lookup函数中引发溢出错误。

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

Alsaplayer Alsaplayer 0.99.76

Debian alsaplayer-alsa_0.99.76-0.3sarge1_amd64.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_amd64.deb

Debian alsaplayer-alsa_0.99.76-0.3sarge1_arm.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_arm.deb

Debian alsaplayer-alsa_0.99.76-0.3sarge1_hppa.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_hppa.deb

Debian alsaplayer-alsa_0.99.76-0.3sarge1_i386.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_i386.deb

Debian alsaplayer-alsa_0.99.76-0.3sarge1_ia64.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_ia64.deb

Debian alsaplayer-alsa_0.99.76-0.3sarge1_m68k.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_m68k.deb

Debian alsaplayer-alsa_0.99.76-0.3sarge1_mips.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_mips.deb

Debian alsaplayer-alsa_0.99.76-0.3sarge1_mipsel.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_mipsel.deb

Debian alsaplayer-alsa_0.99.76-0.3sarge1_powerpc.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_powerpc.deb

Debian alsaplayer-alsa_0.99.76-0.3sarge1_s390.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_s390.deb

Debian alsaplayer-alsa_0.99.76-0.3sarge1_sparc.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-a lsa_0.99.76-0.3sarge1_sparc.deb

Debian alsaplayer-common_0.99.76-0.3sarge1_amd64.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-c ommon_0.99.76-0.3sarge1_amd64.deb

Debian alsaplayer-common_0.99.76-0.3sarge1_arm.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-c ommon_0.99.76-0.3sarge1_arm.deb

Debian alsaplayer-common_0.99.76-0.3sarge1_hppa.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-c ommon_0.99.76-0.3sarge1_hppa.deb

Debian alsaplayer-common_0.99.76-0.3sarge1_i386.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-c ommon_0.99.76-0.3sarge1_i386.deb

Debian alsaplayer-common_0.99.76-0.3sarge1_ia64.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-c ommon_0.99.76-0.3sarge1_ia64.deb

Debian alsaplayer-common_0.99.76-0.3sarge1_m68k.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-c ommon_0.99.76-0.3sarge1_m68k.deb

Debian alsaplayer-common_0.99.76-0.3sarge1_mips.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-c ommon_0.99.76-0.3sarge1_mips.deb

Debian alsaplayer-common_0.99.76-0.3sarge1_mipsel.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-c ommon_0.99.76-0.3sarge1_mipsel.deb

Debian alsaplayer-common_0.99.76-0.3sarge1_powerpc.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-c ommon_0.99.76-0.3sarge1_powerpc.deb

Debian alsaplayer-common_0.99.76-0.3sarge1_s390.deb

Debian GNU/Linux 3.1 alias sarge

http://security.debian.org/pool/updates/main/a/alsaplayer/alsaplayer-c ommon_0.99.76-0.

来源: BID

名称: 19450

链接:http://www.securityfocus.com/bid/19450

来源: BUGTRAQ

名称: 20060809 Multiple buffer-overflows in AlsaPlayer 0.99.76

链接:http://www.securityfocus.com/archive/1/archive/1/442725/100/0/threaded

来源: XF

名称: alsaplayer-cddblookup-bo(28308)

链接:http://xforce.iss.net/xforce/xfdb/28308

来源: XF

名称: alsaplayer-gtkplaylist-bo(28307)

链接:http://xforce.iss.net/xforce/xfdb/28307

来源: XF

名称: alsaplayer-reconnect-bo(28306)

链接:http://xforce.iss.net/xforce/xfdb/28306

来源: OSVDB

名称: 27885

链接:http://www.osvdb.org/27885

来源: OSVDB

名称: 27884

链接:http://www.osvdb.org/27884

来源: OSVDB

名称: 27883

链接:http://www.osvdb.org/27883

来源: SUSE

名称: SUSE-SR:2006:021

链接:http://www.novell.com/linux/security/advisories/2006_21_sr.html

来源: VUPEN

名称: ADV-2006-3235

链接:http://www.frsirt.com/english/advisories/2006/3235

来源: DEBIAN

名称: DSA-1179

链接:http://www.debian.org/security/2006/dsa-1179

来源: SREASON

名称: 1356

链接:http://securityreason.com/securityalert/1356

来源: GENTOO

名称: GLSA-200608-24

链接:http://security.gentoo.org/glsa/glsa-200608-24.xml

来源: SECUNIA

名称: 22018

链接:http://secunia.com/advisories/22018

来源: SECUNIA

名称: 21749

链接:http://secunia.com/advisories/21749

来源: SECUNIA

名称: 21639

链接:http://secunia.com/advisories/21639

来源: SECUNIA

名称: 21422

链接:http://secunia.com/advisories/21422

来源: FULLDISC

名称: 20060809 Multiple buffer-overflows in AlsaPlayer 0.99.76

链接:http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0249.html

来源: MISC

链接:http://aluigi.altervista.org/adv/alsapbof-adv.txt