ID OPENVAS:1361412562310873450 Type openvas Reporter Copyright (C) 2017 Greenbone Networks GmbH Modified 2017-09-29T00:00:00
Description
Check the version of mpg123
###############################################################################
# OpenVAS Vulnerability Test
# $Id: gb_fedora_2017_172410ec92_mpg123_fc25.nasl 7318 2017-09-29 05:31:27Z asteins $
#
# Fedora Update for mpg123 FEDORA-2017-172410ec92
#
# Authors:
# System Generated Check
#
# Copyright:
# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
# (or any later version), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.873450");
script_version("$Revision: 7318 $");
script_tag(name:"last_modification", value:"$Date: 2017-09-29 07:31:27 +0200 (Fri, 29 Sep 2017) $");
script_tag(name:"creation_date", value:"2017-09-28 09:15:24 +0200 (Thu, 28 Sep 2017)");
script_cve_id("CVE-2017-10683", "CVE-2017-11126", "CVE-2017-9545", "CVE-2017-12797");
script_tag(name:"cvss_base", value:"5.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:P");
script_tag(name:"qod_type", value:"package");
script_name("Fedora Update for mpg123 FEDORA-2017-172410ec92");
script_tag(name: "summary", value: "Check the version of mpg123");
script_tag(name: "vuldetect", value: "Get the installed version with the help
of detect NVT and check if the version is vulnerable or not.");
script_tag(name: "insight", value: "Real time MPEG 1.0/2.0/2.5 audio player/decoder
for layers 1, 2 and 3 (most commonly MPEG 1.0 layer 3 aka MP3), as well as re-usable
decoding and output libraries.");
script_tag(name: "affected", value: "mpg123 on Fedora 25");
script_tag(name: "solution", value: "Please Install the Updated Packages.");
script_xref(name: "FEDORA", value: "2017-172410ec92");
script_xref(name: "URL" , value: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZHNBDN6LWCRTV7QEIMAIFPWWVHWIVKZ");
script_tag(name:"solution_type", value:"VendorFix");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2017 Greenbone Networks GmbH");
script_family("Fedora Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/fedora", "ssh/login/rpms");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-rpm.inc");
release = get_kb_item("ssh/login/release");
res = "";
if(release == NULL){
exit(0);
}
if(release == "FC25")
{
if ((res = isrpmvuln(pkg:"mpg123", rpm:"mpg123~1.25.6~1.fc25", rls:"FC25")) != NULL)
{
security_message(data:res);
exit(0);
}
if (__pkg_match) exit(99); # Not vulnerable.
exit(0);
}
{"id": "OPENVAS:1361412562310873450", "bulletinFamily": "scanner", "title": "Fedora Update for mpg123 FEDORA-2017-172410ec92", "description": "Check the version of mpg123", "published": "2017-09-28T00:00:00", "modified": "2017-09-29T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873450", "reporter": "Copyright (C) 2017 Greenbone Networks GmbH", "references": ["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZHNBDN6LWCRTV7QEIMAIFPWWVHWIVKZ", "2017-172410ec92"], "cvelist": ["CVE-2017-12797", "CVE-2017-9545", "CVE-2017-10683", "CVE-2017-11126"], "type": "openvas", "lastseen": "2017-09-29T14:19:48", "history": [], "edition": 1, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cvelist", "hash": "2d87df38a56cc4701b0432ecd321e813"}, {"key": "cvss", "hash": "84813b1457b92d6ba1174abffbb83a2f"}, {"key": "description", "hash": "dd98ad34040dfeaf62cde087ce9eef2b"}, {"key": "href", "hash": "c213c21617b267c9eb9d2f48ea7211c5"}, {"key": "modified", "hash": "a4f45435fef806a7a378042f63ee9e95"}, {"key": "naslFamily", "hash": "be931514784f88df80712740ad2723e7"}, {"key": "pluginID", "hash": "8ae23f3f39c3488d34710424a1557159"}, {"key": "published", "hash": "1b80047fc25e133e710f5dd7f80138f4"}, {"key": "references", "hash": "a284430ed1321b9730ad1dc252286816"}, {"key": "reporter", "hash": "a2323bbbec1269474bb5afba0147298f"}, {"key": "sourceData", "hash": "f39c9a1fc49d164063fd20bd132aad9b"}, {"key": "title", "hash": "ed3b727e375b57c87b120d03c6a7a8c9"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}], "hash": "395b2c00e4210811fcbb6096e0f8f2fa87d8d4d0614f86e0e62417f9e9de10b7", "viewCount": 0, "enchantments": {"vulnersScore": 5.5}, "objectVersion": "1.3", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_172410ec92_mpg123_fc25.nasl 7318 2017-09-29 05:31:27Z asteins $\n#\n# Fedora Update for mpg123 FEDORA-2017-172410ec92\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873450\");\n script_version(\"$Revision: 7318 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-09-29 07:31:27 +0200 (Fri, 29 Sep 2017) $\");\n script_tag(name:\"creation_date\", value:\"2017-09-28 09:15:24 +0200 (Thu, 28 Sep 2017)\");\n script_cve_id(\"CVE-2017-10683\", \"CVE-2017-11126\", \"CVE-2017-9545\", \"CVE-2017-12797\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for mpg123 FEDORA-2017-172410ec92\");\n script_tag(name: \"summary\", value: \"Check the version of mpg123\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help \nof detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"Real time MPEG 1.0/2.0/2.5 audio player/decoder \nfor layers 1, 2 and 3 (most commonly MPEG 1.0 layer 3 aka MP3), as well as re-usable \ndecoding and output libraries.\");\n script_tag(name: \"affected\", value: \"mpg123 on Fedora 25\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n\n script_xref(name: \"FEDORA\", value: \"2017-172410ec92\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZHNBDN6LWCRTV7QEIMAIFPWWVHWIVKZ\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC25\")\n{\n\n if ((res = isrpmvuln(pkg:\"mpg123\", rpm:\"mpg123~1.25.6~1.fc25\", rls:\"FC25\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "naslFamily": "Fedora Local Security Checks", "pluginID": "1361412562310873450"}
{"result": {"cve": [{"id": "CVE-2017-12797", "type": "cve", "title": "CVE-2017-12797", "description": "Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers to cause a denial of service via a crafted file, which triggers a heap-based buffer overflow.", "published": "2017-08-29T11:29:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12797", "cvelist": ["CVE-2017-12797"], "lastseen": "2017-09-07T12:06:26"}, {"id": "CVE-2017-9545", "type": "cve", "title": "CVE-2017-9545", "description": "The next_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows remote attackers to cause a denial of service (buffer over-read) via a crafted mp3 file.", "published": "2017-07-27T02:29:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9545", "cvelist": ["CVE-2017-9545"], "lastseen": "2017-08-10T10:43:46"}, {"id": "CVE-2017-10683", "type": "cve", "title": "CVE-2017-10683", "description": "In mpg123 1.25.0, there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c. A crafted input will lead to a remote denial of service attack.", "published": "2017-06-29T19:29:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-10683", "cvelist": ["CVE-2017-10683"], "lastseen": "2017-07-06T02:16:47"}, {"id": "CVE-2017-11126", "type": "cve", "title": "CVE-2017-11126", "description": "The III_i_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the \"block_type != 2\" case, a similar issue to CVE-2017-9870.", "published": "2017-07-09T23:29:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11126", "cvelist": ["CVE-2017-11126"], "lastseen": "2017-07-14T10:49:00"}], "nessus": [{"id": "OPENSUSE-2017-1035.NASL", "type": "nessus", "title": "openSUSE Security Update : mpg123 (openSUSE-2017-1035)", "description": "This update for mpg123 fixes the following issues :\n\n - Update to version 1.25.6\n\n - Hotfix for bug 255: Overflow reading frame data bits in layer II decoding. Now, all-zero data is returned if the frame data is exhausted. This might have a slight impact on performance, but not easily measurable so far.\n\n - Update to version 1.25.5\n\n - Avoid another buffer read overflow in the ID3 parser on 32 bit platforms (bug 254). (CVE-2017-12797/boo#1056999)\n\n - Update to version 1.25.4 libmpg123 :\n\n - Prevent harmless call to memcpy(NULL, NULL, 0).\n\n - More early checking of ID3v2 encoding values to avoid bogus text being stored.", "published": "2017-09-14T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103203", "cvelist": ["CVE-2017-12797"], "lastseen": "2018-01-27T03:11:05"}, {"id": "FEDORA_2017-12794057A6.NASL", "type": "nessus", "title": "Fedora 27 : mpg123 (2017-12794057a6)", "description": "Update to upstream release 1.25.6\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2018-01-15T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=105818", "cvelist": ["CVE-2017-10683"], "lastseen": "2018-02-02T01:06:15"}, {"id": "DEBIAN_DLA-1017.NASL", "type": "nessus", "title": "Debian DLA-1017-1 : mpg123 security update", "description": "It was discovered that there was a remote denial of service vulnerability in the mpg123 audio library/player. This was caused by a heap-based buffer over-read in the 'convert_latin1' function.\n\nFor Debian 7 'Wheezy', this issue has been fixed in mpg123 version 1.14.4-1+deb7u2.\n\nWe recommend that you upgrade your mpg123 packages.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2017-07-10T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=101318", "cvelist": ["CVE-2017-10683"], "lastseen": "2018-01-30T01:11:36"}, {"id": "FEDORA_2017-172410EC92.NASL", "type": "nessus", "title": "Fedora 25 : mpg123 (2017-172410ec92)", "description": "Update to upstream release 1.25.6\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2017-09-29T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103540", "cvelist": ["CVE-2017-10683"], "lastseen": "2018-02-02T01:09:15"}, {"id": "OPENSUSE-2017-1139.NASL", "type": "nessus", "title": "openSUSE Security Update : mpg123 (openSUSE-2017-1139)", "description": "This update for mpg123 to version 1.25.7 fixes the following issues :\n\n - CVE-2017-10683: Improvement over previous fix for xrpnt overflow problems (boo#1046766)\n\nThe following changes are also included in version 1.25.7 :\n\n - Do not play with cursor and inverse video for progress bar when TERM=dumb\n\n - Fix parsing of host port for numerical IPv6 addresses", "published": "2017-10-11T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103763", "cvelist": ["CVE-2017-10683"], "lastseen": "2018-01-27T02:58:01"}, {"id": "FEDORA_2017-C89D94D812.NASL", "type": "nessus", "title": "Fedora 26 : mpg123 (2017-c89d94d812)", "description": "Update to upstream release 1.25.6\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2017-09-21T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=103366", "cvelist": ["CVE-2017-10683"], "lastseen": "2018-02-04T10:57:29"}], "openvas": [{"id": "OPENVAS:1361412562310873442", "type": "openvas", "title": "Fedora Update for mpg123 FEDORA-2017-c89d94d812", "description": "Check the version of mpg123", "published": "2017-09-21T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873442", "cvelist": ["CVE-2017-12797", "CVE-2017-9545", "CVE-2017-10683", "CVE-2017-11126"], "lastseen": "2017-10-30T10:57:23"}, {"id": "OPENVAS:1361412562310891017", "type": "openvas", "title": "Debian LTS Advisory ([SECURITY] [DLA 1017-1] mpg123 security update)", "description": "It was discovered that there was a remote denial of service vulnerability in\nthe mpg123 audio library/player. This was caused by a heap-based buffer\nover-read in the ", "published": "2018-02-05T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891017", "cvelist": ["CVE-2017-10683"], "lastseen": "2018-03-29T18:48:06"}]}}