Xiph.Org libvorbis mapping0.c mapping0_forward memory corruption

Summaryinfo

A vulnerability categorized as critical has been discovered in Xiph.Org libvorbis mapping0.c. This issue affects the function mapping0_forward of the file mapping0.c. The manipulation results in memory corruption. This vulnerability is reported as CVE-2018-10392. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Xiph.Org libvorbis mapping0.c. It has been classified as critical. Affected is the function mapping0_forward of the file mapping0.c. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly have unspecified other impact via a crafted file.

The bug was discovered 04/25/2018. The weakness was disclosed 04/26/2018 (Website). The advisory is shared for download at gitlab.xiph.org. This vulnerability is traded as CVE-2018-10392 since 04/25/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 111093 (openSUSE Security Update : libvorbis (openSUSE-2018-722)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 277425 (Fedora Security Update for libvorbis (FEDORA-2018-0259281ab6)).

Upgrading eliminates this vulnerability. A possible mitigation has been published 3 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (111093). The entries VDB-104686, VDB-104701, VDB-106940 and VDB-106950 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Xiph.Org

Name

• libvorbis

Version

• mapping0.c

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion