mpg123 1.25.0 libmpg123/id3.c convert_latin1 memory corruption

Summaryinfo

A vulnerability described as problematic has been identified in mpg123 1.25.0. The impacted element is the function convert_latin1 of the file libmpg123/id3.c. The manipulation results in memory corruption. This vulnerability is reported as CVE-2017-10683. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in mpg123 1.25.0. It has been classified as problematic. Affected is the function convert_latin1 of the file libmpg123/id3.c. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on availability. CVE summarizes:

In mpg123 1.25.0, there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c. A crafted input will lead to a remote denial of service attack.

The bug was discovered 06/28/2017. The weakness was disclosed 06/29/2017 (Website). The advisory is shared for download at bugzilla.redhat.com. This vulnerability is traded as CVE-2017-10683 since 06/29/2017. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 101318 (Debian DLA-1017-1 : mpg123 security update), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Debian Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 170442 (OpenSUSE Security Update for mpg123 (openSUSE-SU-2017:2682-1)).

Upgrading eliminates this vulnerability. A possible mitigation has been published 2 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (101318). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• mpg123

Version

• 1.25.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion