dBpowerAMP Music Converter file name buffer overflow
| dbpoweramp-converter-filename-bo (17539) |  High Risk |
Description:
dBpowerAMP Music Converter is vulnerable to a buffer overflow, caused by improper bounds checking of file names in the .pls and .m3u playlists and .mcc (Music Collection) files. A remote attacker could exploit this vulnerability by creating a specially-crafted .pls, .m3u or .mcc file and hosting the malicious file on a Web site to overflow a buffer and execute arbitrary code on the system.
Platforms Affected:
- illustrate, dBpowerAMP Music Converter 10.0
Remedy:
No remedy available as of June 27, 2009.
Consequences:
Gain Access
References:
- dbPowerAmp Buffer Overflow And DoS Vulnerabilities September 27, 2004, GulfTech Research and Development at http://www.gulftech.org/?node=research&article_id=00052-09272004.
- dBpowerAMP Web site, dBpowerAMP Music Converter at http://www.dbpoweramp.com/dmc.htm.
- BID-11266: Illustrate dBpowerAMP Music Converter and Audio Player Buffer Overflow Vulnerabilities
- CVE-2004-1569: Buffer overflow in (1) MusicConverter.exe, (2) playlist.exe, and (3) amp.exe in dBpowerAMP Audio Player 2.0 and dbPowerAmp Music Converter 10.0 allows remote attackers to cause a denial of service or execute arbitrary code via a .pls or .m3u playlist that contains long File1 (filename) fields.
- CVE-2005-4648: Buffer overflow in Illustrate dBpowerAMP Music Converter 11.5 and earlier, possibly including (1) MusicConverter.exe, (2) playlist.exe, and (3) amp.exe, allows user-assisted attackers to cause a denial of service or execute arbitrary code via a .m3u playlist with a long entry, possibly involving large field names, as demonstrated by SecuBox.Labs.m3u. NOTE: this issue might be the same as the .m3u vulnerability in CVE-2004-1569, but if so, then CD:SF-LOC suggests creating a different identifier since the .m3u issue would affect different versions than the .pls issue.
- SA12684: dBpowerAMP Audio Player / Music Converter Playlist Handling Buffer Overflow
- SECTRACK ID: 1015415: dBpowerAMP Music Converter Buffer Overflow in `.m3u` Playlist Files May Let Remote Users Execute Arbitrary Code
Reported:
Sep 29, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net