Re: CVE request: libcdaudio

[Thomas Biege <thomas () suse de>]

On Tue, Nov 11, 2008 at 09:22:16AM +0100, Tomas Hoger wrote:
> On Mon, 10 Nov 2008 10:20:41 -0500 (EST) "Steven M. Christey"
> <coley () linus mitre org> wrote:
>
> > > we need a CVE-ID for a buffer overflow in libcdaudio.
> > > It is a remotely exploitable heap-based buffer overflow.
> >
> > Out of curiosity, what makes it remote?
> >
> > Use CVE-2008-5030
>
> I guess this wording was used by Thomas as the affected code is used to
> talk to remote CDDB servers, from which you obtain list of tracks for
> your audio CD.  If remote CDDB server is untrusted / compromised, it
> can send you a crafted reply that can exploit libcdaudio flaw on your
> system.

Yes, everybody can add CDDB entries to servers like freedb.org (honestly
I didn't test it) or intercept the HTTP connection to a CDDB server.


-- 
Bye,
     Thomas
-- 
 Thomas Biege <thomas () suse de>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
-- 
           Hamming's Motto:
           The purpose of computing is insight, not numbers.
                                -- Richard W. Hamming