ID de Prueba:	1.3.6.1.4.1.25623.1.0.63702
Categoría:	FreeBSD Local Security Checks
Título:	FreeBSD Ports: amarok
Resumen:	The remote host is missing an update to the system; as announced in the referenced advisory.
Descripción:	Summary: The remote host is missing an update to the system as announced in the referenced advisory. Vulnerability Insight: The following package is affected: amarok CVE-2009-0135 Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers a heap-based buffer overflow. CVE-2009-0136 Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted (1) nlen or (2) vlen Tag value, each of which can lead to an invalid pointer dereference, or the writing of a 0x00 byte to an arbitrary memory location, after an allocation failure. Solution: Update your system with the appropriate patches or software upgrades. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0135 BugTraq ID: 33210 http://www.securityfocus.com/bid/33210 Bugtraq: 20090111 [TKADV2009-002] Amarok Integer Overflow and Unchecked Allocation Vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/499984/100/0/threaded Debian Security Information: DSA-1706 (Google Search) http://www.debian.org/security/2009/dsa-1706 https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00708.html http://security.gentoo.org/glsa/glsa-200903-34.xml http://www.mandriva.com/security/advisories?name=MDVSA-2009:030 http://trapkit.de/advisories/TKADV2009-002.txt http://openwall.com/lists/oss-security/2009/01/14/2 http://www.securitytracker.com/id?1021558 http://secunia.com/advisories/33505 http://secunia.com/advisories/33522 http://secunia.com/advisories/33640 http://secunia.com/advisories/33819 http://secunia.com/advisories/34315 http://secunia.com/advisories/34407 http://securityreason.com/securityalert/4915 SuSE Security Announcement: SUSE-SR:2009:003 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html http://www.ubuntu.com/usn/USN-739-1 http://www.vupen.com/english/advisories/2009/0100 Common Vulnerability Exposure (CVE) ID: CVE-2009-0136
Copyright	Copyright (C) 2009 E-Soft Inc.

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.