{"id": "CVE-2007-0578", "bulletinFamily": "NVD", "title": "CVE-2007-0578", "description": "The http_open function in httpget.c in mpg123 before 0.64 allows remote attackers to cause a denial of service (infinite loop) by closing the HTTP connection early.", "published": "2007-01-30T17:28:00", "modified": "2011-03-08T02:50:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-0578", "reporter": "cve@mitre.org", "references": ["http://sourceforge.net/project/shownotes.php?group_id=135704&release_id=478747", "http://www.securityfocus.com/bid/22274", "http://www.mpg123.de/cgi-bin/news.cgi", "http://www.vupen.com/english/advisories/2007/0366", "http://www.mandriva.com/security/advisories?name=MDKSA-2007:032", "http://osvdb.org/40128"], "cvelist": ["CVE-2007-0578"], "type": "cve", "lastseen": "2019-05-29T18:08:58", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "7e9a7d61ef0d9722eb38665e476852d3"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "99ba2747eb98ed44c80f8c4fc7d9c350"}, {"key": "cpe23", "hash": "7d3a05b056bff545a0b872c593784b5b"}, {"key": "cvelist", "hash": "cffa47fb2a96d17d394cc61d5f46204c"}, {"key": "cvss", "hash": "741b18e744e3f37108cd8c3f4a1c6ef7"}, {"key": "cvss2", "hash": "497bc610268b9555b01688437435adc2"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "1949f67fc5f480245f777b21d15b385e"}, {"key": "href", "hash": "1093b91b1a902061a3cbc353ba1b8777"}, {"key": "modified", "hash": "1b60e43d480e0cc349dad36175d87df1"}, {"key": "published", "hash": "fdaf34b68489775de149f00e4d683144"}, {"key": "references", "hash": "9cacd7e57cab1c8a12e5ea9178f54fd1"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "986db385c6b226c78bdbac8d92074d29"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "a43c4294fe5c13489962819edc77f19502e4489a67d6a3a41fc574438a59584d", "viewCount": 0, "enchantments": {"score": {"value": 5.2, "vector": "NONE", "modified": "2019-05-29T18:08:58"}, "dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:830242", "OPENVAS:1361412562310830242"]}, {"type": "nessus", "idList": ["MANDRAKE_MDKSA-2007-032.NASL"]}, {"type": "osvdb", "idList": ["OSVDB:40128"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7164"]}], "modified": "2019-05-29T18:08:58"}, "vulnersScore": 5.2}, "objectVersion": "1.3", "cpe": ["cpe:/a:mpg123:mpg123:0.59o", "cpe:/a:mpg123:mpg123:0.59r", "cpe:/a:mpg123:mpg123:0.59m", "cpe:/a:mpg123:mpg123:0.59s", "cpe:/a:mpg123:mpg123:0.63", "cpe:/a:mpg123:mpg123:0.59p", "cpe:/a:mpg123:mpg123:0.62", "cpe:/a:mpg123:mpg123:0.59n", "cpe:/a:mpg123:mpg123:pre0.59s_r11", "cpe:/a:mpg123:mpg123:0.59q", "cpe:/a:mpg123:mpg123:pre0.59s"], "affectedSoftware": [{"name": "mpg123 mpg123", "operator": "eq", "version": "0.59p"}, {"name": "mpg123 mpg123", "operator": "eq", "version": "0.62"}, {"name": "mpg123 mpg123", "operator": "eq", "version": "pre0.59s"}, {"name": "mpg123 mpg123", "operator": "eq", "version": "0.59s"}, {"name": "mpg123 mpg123", "operator": "eq", "version": "0.59r"}, {"name": "mpg123 mpg123", "operator": "eq", "version": "0.59o"}, {"name": "mpg123 mpg123", "operator": "eq", "version": "pre0.59s_r11"}, {"name": "mpg123 mpg123", "operator": "eq", "version": "0.59n"}, {"name": "mpg123 mpg123", "operator": "eq", "version": "0.63"}, {"name": "mpg123 mpg123", "operator": "eq", "version": "0.59m"}, {"name": "mpg123 mpg123", "operator": "eq", "version": "0.59q"}], "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {}, "cpe23": ["cpe:2.3:a:mpg123:mpg123:pre0.59s_r11:*:*:*:*:*:*:*", "cpe:2.3:a:mpg123:mpg123:0.59o:*:*:*:*:*:*:*", "cpe:2.3:a:mpg123:mpg123:pre0.59s:*:*:*:*:*:*:*", "cpe:2.3:a:mpg123:mpg123:0.59m:*:*:*:*:*:*:*", "cpe:2.3:a:mpg123:mpg123:0.63:*:*:*:*:*:*:*", "cpe:2.3:a:mpg123:mpg123:0.59p:*:*:*:*:*:*:*", "cpe:2.3:a:mpg123:mpg123:0.59r:*:*:*:*:*:*:*", "cpe:2.3:a:mpg123:mpg123:0.59q:*:*:*:*:*:*:*", "cpe:2.3:a:mpg123:mpg123:0.59s:*:*:*:*:*:*:*", "cpe:2.3:a:mpg123:mpg123:0.62:*:*:*:*:*:*:*", "cpe:2.3:a:mpg123:mpg123:0.59n:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"]}

{"osvdb": [{"lastseen": "2017-04-28T13:20:36", "bulletinFamily": "software", "description": "## Solution Description\nUpgrade to version 0.64 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\nVendor Specific News/Changelog Entry: http://sourceforge.net/project/shownotes.php?group_id=135704&release_id=478747\nVendor Specific News/Changelog Entry: http://www.mpg123.de/cgi-bin/news.cgi\nOther Advisory URL: http://www.mandriva.com/security/advisories?name=MDKSA-2007:032\nFrSIRT Advisory: ADV-2007-0366\n[CVE-2007-0578](https://vulners.com/cve/CVE-2007-0578)\nBugtraq ID: 22274\n", "modified": "2007-01-15T11:23:35", "published": "2007-01-15T11:23:35", "href": "https://vulners.com/osvdb/OSVDB:40128", "id": "OSVDB:40128", "title": "mpg123 httpget.c http_open() Function Remote DoS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:23", "bulletinFamily": "software", "description": "Ebdless loop in HTTP client code if HTTP server closes connection before file ctransferred completely.", "modified": "2007-02-03T00:00:00", "published": "2007-02-03T00:00:00", "id": "SECURITYVULNS:VULN:7164", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:7164", "title": "mpg123 audio player DoS", "type": "securityvulns", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "openvas": [{"lastseen": "2017-07-24T12:56:44", "bulletinFamily": "scanner", "description": "Check for the Version of mpg123", "modified": "2017-07-06T00:00:00", "published": "2009-04-09T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=830242", "id": "OPENVAS:830242", "title": "Mandriva Update for mpg123 MDKSA-2007:032 (mpg123)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for mpg123 MDKSA-2007:032 (mpg123)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The http_open function in httpget.c in mpg123 before 0.64 allows remote\n attackers to cause a denial of service (infinite loop) by closing the\n HTTP connection early.\n\n Packages have been patched to correct this issue.\";\n\ntag_affected = \"mpg123 on Mandriva Linux 2006.0,\n Mandriva Linux 2006.0/X86_64,\n Mandriva Linux 2007.0,\n Mandriva Linux 2007.0/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2007-02/msg00001.php\");\n script_id(830242);\n script_version(\"$Revision: 6568 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:04:21 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-09 13:53:01 +0200 (Thu, 09 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"MDKSA\", value: \"2007:032\");\n script_cve_id(\"CVE-2007-0578\");\n script_name( \"Mandriva Update for mpg123 MDKSA-2007:032 (mpg123)\");\n\n script_summary(\"Check for the Version of mpg123\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2007.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"mpg123\", rpm:\"mpg123~0.60~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2006.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"mpg123\", rpm:\"mpg123~0.59r~23.2.20060mdk\", rls:\"MNDK_2006.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-04-09T11:40:26", "bulletinFamily": "scanner", "description": "Check for the Version of mpg123", "modified": "2018-04-06T00:00:00", "published": "2009-04-09T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310830242", "id": "OPENVAS:1361412562310830242", "type": "openvas", "title": "Mandriva Update for mpg123 MDKSA-2007:032 (mpg123)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for mpg123 MDKSA-2007:032 (mpg123)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The http_open function in httpget.c in mpg123 before 0.64 allows remote\n attackers to cause a denial of service (infinite loop) by closing the\n HTTP connection early.\n\n Packages have been patched to correct this issue.\";\n\ntag_affected = \"mpg123 on Mandriva Linux 2006.0,\n Mandriva Linux 2006.0/X86_64,\n Mandriva Linux 2007.0,\n Mandriva Linux 2007.0/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2007-02/msg00001.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.830242\");\n script_version(\"$Revision: 9370 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 10:53:14 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-09 13:53:01 +0200 (Thu, 09 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"MDKSA\", value: \"2007:032\");\n script_cve_id(\"CVE-2007-0578\");\n script_name( \"Mandriva Update for mpg123 MDKSA-2007:032 (mpg123)\");\n\n script_tag(name:\"summary\", value:\"Check for the Version of mpg123\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2007.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"mpg123\", rpm:\"mpg123~0.60~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2006.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"mpg123\", rpm:\"mpg123~0.59r~23.2.20060mdk\", rls:\"MNDK_2006.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "nessus": [{"lastseen": "2019-12-13T08:05:31", "bulletinFamily": "scanner", "description": "The http_open function in httpget.c in mpg123 before 0.64 allows\nremote attackers to cause a denial of service (infinite loop) by\nclosing the HTTP connection early.\n\nPackages have been patched to correct this issue.", "modified": "2019-12-02T00:00:00", "id": "MANDRAKE_MDKSA-2007-032.NASL", "href": "https://www.tenable.com/plugins/nessus/24645", "published": "2007-02-18T00:00:00", "title": "Mandrake Linux Security Advisory : mpg123 (MDKSA-2007:032)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandrake Linux Security Advisory MDKSA-2007:032. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(24645);\n script_version (\"1.15\");\n script_cvs_date(\"Date: 2019/08/02 13:32:48\");\n\n script_cve_id(\"CVE-2007-0578\");\n script_xref(name:\"MDKSA\", value:\"2007:032\");\n\n script_name(english:\"Mandrake Linux Security Advisory : mpg123 (MDKSA-2007:032)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Mandrake Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The http_open function in httpget.c in mpg123 before 0.64 allows\nremote attackers to cause a denial of service (infinite loop) by\nclosing the HTTP connection early.\n\nPackages have been patched to correct this issue.\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected mpg123 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:mpg123\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2006\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/02/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/02/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2006.0\", reference:\"mpg123-0.59r-23.2.20060mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK2007.0\", reference:\"mpg123-0.60-2.1mdv2007.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}]}