CVE-2006-4089 Memory corruption in n/a
Remote attackers can cause denial of service or potentially execute code via buffer overflows in AlsaPlayer when processing malicious web or CDDB responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2006-4089?
CVE-2006-4089 is a medium-severity memory corruption vulnerability in n/a, published on 11 Aug 2006. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple buffer overflows in Andy Lo-A-Foe AlsaPlayer 0.99.76 and earlier allow remote attackers to cause a denial of service (application crash), or have other unknown impact, via (1) a long Location field sent by a web server, which triggers an overflow in the reconnect function in reader/http/http.c; (2) a long URL sent by a web server when AlsaPlayer is seeking a media file for the playlist, which triggers overflows in new_list_item and CbUpdated in interface/gtk/PlaylistWindow.cpp; and (3) a long response sent by a CDDB server, which triggers an overflow in cddb_lookup in input/ccda/cdda_engine.c.
Which versions are affected by CVE-2006-4089?
It affects 1 product.
Products include Andy Lo-a-Foe Alsaplayer.
How do I fix CVE-2006-4089?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2006-4089 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-4089 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as DEBIAN-CVE-2006-4089, DSA-1179-1, GHSA-7hmv-cv83-p85q.