ID de Prueba:	1.3.6.1.4.1.25623.1.0.55604
Categoría:	Mandrake Local Security Checks
Título:	Mandrake Security Advisory MDKSA-2005:180 (xine-lib)
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing an update to xine-lib announced via advisory MDKSA-2005:180. When playing an Audio CD, a xine-lib based media application contacts a CDDB server to retrieve metadata like the title and artist's name. During processing of this data, a response from the server, which is located in memory on the stack, is passed to the fprintf() function as a format string. An attacker can set up a malicious CDDB server and trick the client into using this server instead of the pre- configured one. Alternatively, any user and therefore the attacker can modify entries in the official CDDB server. Using this format string vulnerability, attacker-chosen data can be written to an attacker-chosen memory location. This allows the attacker to alter the control flow and to execute malicious code with the permissions of the user running the application. This problem was reported by Ulf Harnhammar from the Debian Security Audit Project. The updated packages have been patched to correct this problem. Affected versions: 10.1, 10.2, 2006.0, Corporate 3.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. https://secure1.securityspace.com/smysecure/catid.html?in=MDKSA-2005:180 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2967 http://xinehq.de/index.php/security/XSA-2005-1 Risk factor : High CVSS Score: 7.5
Referencia Cruzada:	BugTraq ID: 15044 Common Vulnerability Exposure (CVE) ID: CVE-2005-2967 http://www.securityfocus.com/bid/15044 Debian Security Information: DSA-863 (Google Search) http://www.debian.org/security/2005/dsa-863 http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0196.html http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml http://www.mandriva.com/security/advisories?name=MDKSA-2005:180 http://www.osvdb.org/19892 http://secunia.com/advisories/17097 http://secunia.com/advisories/17099/ http://secunia.com/advisories/17111 http://secunia.com/advisories/17132 http://secunia.com/advisories/17162 http://secunia.com/advisories/17179 http://secunia.com/advisories/17282 http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.415454 SuSE Security Announcement: SUSE-SR:2005:024 (Google Search) http://www.novell.com/linux/security/advisories/2005_24_sr.html http://www.ubuntu.com/usn/usn-196-1 XForce ISS Database: xinelib-inputcdda-format-string(22545) https://exchange.xforce.ibmcloud.com/vulnerabilities/22545
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.