media-sound/amarok-3.3.3 — Security Advisories

▸ GLSA 200903-34 Amarok: User-assisted execution of arbitrary code this version unaffected normal remote 2009-03-20

Multiple vulnerabilities in Amarok might allow for user-assisted execution of arbitrary code.

Announced: 2009-03-20
Revised: 2009-03-20
Access: remote
Bugs: #254896
Advisory: https://security.gentoo.org/glsa/200903-34

Affected packages

Package	Arch	Vulnerable	Unaffected
media-sound/amarok	*	< 1.4.10-r2	>= 1.4.10-r2

Background

Amarok is an advanced music player.

Description

Tobias Klein has discovered multiple vulnerabilities in Amarok:

Multiple integer overflows in the Audible::Tag::readTag() function in metadata/audible/audibletag.cpp trigger heap-based buffer overflows (CVE-2009-0135).
Multiple array index errors in the Audible::Tag::readTag() function in metadata/audible/audibletag.cpp can lead to invalid pointer dereferences, or the writing of a 0x00 byte to an arbitrary memory location after an allocation failure (CVE-2009-0136).

Impact

A remote attacker could entice a user to open a specially crafted Audible Audio (.aa) file with a large "nlen" or "vlen" tag value to execute arbitrary code or cause a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All Amarok users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-sound/amarok-1.4.10-r2"

References

▸ GLSA 200809-08 Amarok: Insecure temporary file creation this version unaffected normal local 2008-09-08

Amarok uses temporary files in an insecure manner, allowing for a symlink attack.

Announced: 2008-09-08
Revised: 2008-09-08
Access: local
Bugs: #234689
Advisory: https://security.gentoo.org/glsa/200809-08

Affected packages

Package	Arch	Vulnerable	Unaffected
media-sound/amarok	*	< 1.4.10	>= 1.4.10

Background

Amarok is an advanced music player.

Description

Dwayne Litzenberger reported that the MagnatuneBrowser::listDownloadComplete() function in magnatunebrowser/magnatunebrowser.cpp uses the album_info.xml temporary file in an insecure manner.

Impact

A local attacker could perform a symlink attack to overwrite arbitrary files on the system with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All Amarok users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-sound/amarok-1.4.10"

References

CVE-2008-3699

▸ GLSA 200703-11 Amarok: User-assisted remote execution of arbitrary code this version unaffected normal remote 2007-03-13

The Magnatune component shipped with Amarok is vulnerable to the injection of arbitrary shell code from a malicious Magnatune server.

Announced: 2007-03-13
Revised: 2007-03-13
Access: remote
Bugs: #166901
Advisory: https://security.gentoo.org/glsa/200703-11

Affected packages

Package	Arch	Vulnerable	Unaffected
media-sound/amarok	*	< 1.4.5-r1	>= 1.4.5-r1

Background

Amarok is an advanced music player.

Description

The Magnatune downloader doesn't quote the "m_currentAlbumFileName" parameter while calling the "unzip" shell command.

Impact

A compromised or malicious Magnatune server can remotely execute arbitrary shell code with the rights of the user running Amarok on a client that have previously registered for buying music.

Workaround

Do not use the Magnatune component of Amarok.

Resolution

All Amarok users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-sound/amarok-1.4.5-r1"

References

SA24159