CVE-2008-1423 - Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and ea

CVE-2008-1423

Summary

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow.

References

Vulnerable Configurations

cpe:2.3:o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:itanium:*:*:*:*:*
cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:itanium:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:xiph.org:libvorbis:1.2.0:*:*:*:*:*:*:*

CVSS

Base:	9.3 (as of 29-09-2017 - 01:30)
Impact:
Exploitability:

CWE

CWE-189

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:C/I:C/A:C

oval via4

accepted

2013-04-29T04:22:46.327-04:00

class

vulnerability

contributors

name Aharon Chernin
organization SCAP.com, LLC
name Dragos Prisaca
organization G2, Inc.

definition_extensions

comment The operating system installed on the system is Red Hat Enterprise Linux 3
oval oval:org.mitre.oval:def:11782
comment CentOS Linux 3.x
oval oval:org.mitre.oval:def:16651
comment The operating system installed on the system is Red Hat Enterprise Linux 4
oval oval:org.mitre.oval:def:11831
comment CentOS Linux 4.x
oval oval:org.mitre.oval:def:16636
comment Oracle Linux 4.x
oval oval:org.mitre.oval:def:15990
comment The operating system installed on the system is Red Hat Enterprise Linux 5
oval oval:org.mitre.oval:def:11414
comment The operating system installed on the system is CentOS Linux 5.x
oval oval:org.mitre.oval:def:15802
comment Oracle Linux 5.x
oval oval:org.mitre.oval:def:15459

description

family

unix

oval:org.mitre.oval:def:9851

status

accepted

submitted

2010-07-09T03:56:16-04:00

title

version

redhat via4

advisories

bugzilla

id	440709
title	CVE-2008-1423 vorbis: integer oveflow caused by huge codebooks

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 4 is installed
oval oval:com.redhat.rhba:tst:20070304025

AND
comment libvorbis is earlier than 1:1.1.0-3.el4_6.1
oval oval:com.redhat.rhsa:tst:20080270001
comment libvorbis is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20070845002
AND
comment libvorbis-devel is earlier than 1:1.1.0-3.el4_6.1
oval oval:com.redhat.rhsa:tst:20080270003
comment libvorbis-devel is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20070845004

AND

comment Red Hat Enterprise Linux 5 is installed
oval oval:com.redhat.rhba:tst:20070331005

AND
comment libvorbis is earlier than 1:1.1.2-3.el5_1.2
oval oval:com.redhat.rhsa:tst:20080270006
comment libvorbis is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070845007

AND

comment libvorbis-devel is earlier than 1:1.1.2-3.el5_1.2
oval oval:com.redhat.rhsa:tst:20080270008
comment libvorbis-devel is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070845009

rhsa

id	RHSA-2008:0270
released	2008-05-14
severity	Important
title	RHSA-2008:0270: libvorbis security update (Important)

rhsa
id RHSA-2008:0271

rpms

libvorbis-1:1.0-10.el3
libvorbis-1:1.1.0-3.el4_6.1
libvorbis-1:1.1.2-3.el5_1.2
libvorbis-debuginfo-1:1.0-10.el3
libvorbis-debuginfo-1:1.1.0-3.el4_6.1
libvorbis-debuginfo-1:1.1.2-3.el5_1.2
libvorbis-devel-1:1.0-10.el3
libvorbis-devel-1:1.1.0-3.el4_6.1
libvorbis-devel-1:1.1.2-3.el5_1.2
libvorbis-0:1.0rc2-9.el2
libvorbis-devel-0:1.0rc2-9.el2

refmap via4

bid	29206
confirm	https://bugzilla.redhat.com/show_bug.cgi?id=440709
debian	DSA-1591
fedora	FEDORA-2008-3898 FEDORA-2008-3910 FEDORA-2008-3934
gentoo	GLSA-200806-09
mandriva	MDVSA-2008:102
sectrack	1020029
secunia	30234 30237 30247 30259 30479 30581 30820 32946
suse	SUSE-SR:2008:012
ubuntu	USN-682-1
vupen	ADV-2008-1510
xf	libvorbis-quantvals-quantlist-bo(42403)

Last major update

29-09-2017 - 01:30

Published

16-05-2008 - 12:54

Last modified

29-09-2017 - 01:30