Input validation error in libmodplug (Alpine package)

1) Input validation error

EUVDB-ID: #VU33119

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2011-1761

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (crash) and possibly execute arbitrary code via a crafted ABC file.

Mitigation

Install update from vendor's website.

Vulnerable software versions

libmodplug (Alpine package): 0.8.8.1-r0 - 0.8.8.3-r0

libvpx (Alpine package): 0.9.5-r0 - 0.9.7_p1-r0

CPE2.3

• cpe:2.3:a:alpine:libmodplug_alpine_package:0.8.8.1-r0:*:*:*:*:alpine_linux:*:2.1
• cpe:2.3:a:alpine:libmodplug_alpine_package:0.8.8.1-r1:*:*:*:*:alpine_linux:*:2.1
• cpe:2.3:a:alpine:libmodplug_alpine_package:0.8.8.3-r0:*:*:*:*:alpine_linux:*:2.3
• cpe:2.3:a:alpine:libvpx_alpine_package:0.9.5-r0:*:*:*:*:alpine_linux:*:2.1
• cpe:2.3:a:alpine:libvpx_alpine_package:0.9.6-r1:*:*:*:*:alpine_linux:*:2.1
• cpe:2.3:a:alpine:libvpx_alpine_package:0.9.7_p1-r0:*:*:*:*:alpine_linux:*:2.3

External links

https://git.alpinelinux.org/aports/commit/?id=a9ef511c9fff4837705dc15f48872198a7695388
https://git.alpinelinux.org/aports/commit/?id=f040195474ff46ee96234a1665e67c865fbf4f18
https://git.alpinelinux.org/aports/commit/?id=e500031b7e33e81a58b7281ae7266ebd88a7726c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.