CVE-2003-0969 - Vulnerability Details - OpenCVE

mpg321 0.2.10 allows remote attackers to overwrite memory and possibly execute arbitrary code via an mp3 file that passes certain strings to the printf function, possibly triggering a format string vulnerability.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mpg321	Mpg321

Configuration 1 [-]

cpe:2.3:a:mpg321:mpg321:0.2.10:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.debian.org/security/2004/dsa-411
http://www.novell.com/linux/security/advisories/2004_02_tcpdump.html
http://www.osvdb.org/3331
http://www.securityfocus.com/bid/9364
https://exchange.xforce.ibmcloud.com/vulnerabilities/14148

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2004-09-01T04:00:00

Updated: 2024-08-08T02:12:35.735Z

Reserved: 2003-12-01T00:00:00

Link: CVE-2003-0969

Vulnrichment

No data.

NVD

Status : Modified

Published: 2004-01-20T05:00:00.000

Modified: 2024-11-20T23:45:58.970

Link: CVE-2003-0969

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2004-01-05T00:00:00", "descriptions": [{"lang": "en", "value": "mpg321 0.2.10 allows remote attackers to overwrite memory and possibly execute arbitrary code via an mp3 file that passes certain strings to the printf function, possibly triggering a format string vulnerability."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2007-11-15T00:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "mpg321-mp3-format-string(14148)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14148"}, {"name": "SuSE-SA:2004:002", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://www.novell.com/linux/security/advisories/2004_02_tcpdump.html"}, {"name": "3331", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/3331"}, {"name": "9364", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/9364"}, {"name": "DSA-411", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2004/dsa-411"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2003-0969", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "mpg321 0.2.10 allows remote attackers to overwrite memory and possibly execute arbitrary code via an mp3 file that passes certain strings to the printf function, possibly triggering a format string vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "mpg321-mp3-format-string(14148)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14148"}, {"name": "SuSE-SA:2004:002", "refsource": "SUSE", "url": "http://www.novell.com/linux/security/advisories/2004_02_tcpdump.html"}, {"name": "3331", "refsource": "OSVDB", "url": "http://www.osvdb.org/3331"}, {"name": "9364", "refsource": "BID", "url": "http://www.securityfocus.com/bid/9364"}, {"name": "DSA-411", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2004/dsa-411"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T02:12:35.735Z"}, "title": "CVE Program Container", "references": [{"name": "mpg321-mp3-format-string(14148)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14148"}, {"name": "SuSE-SA:2004:002", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://www.novell.com/linux/security/advisories/2004_02_tcpdump.html"}, {"name": "3331", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/3331"}, {"name": "9364", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/9364"}, {"name": "DSA-411", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2004/dsa-411"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2003-0969", "datePublished": "2004-09-01T04:00:00", "dateReserved": "2003-12-01T00:00:00", "dateUpdated": "2024-08-08T02:12:35.735Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mpg321:mpg321:0.2.10:*:*:*:*:*:*:*", "matchCriteriaId": "2495F9C3-C643-40E7-93FE-9D349CA16D7D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "mpg321 0.2.10 allows remote attackers to overwrite memory and possibly execute arbitrary code via an mp3 file that passes certain strings to the printf function, possibly triggering a format string vulnerability."}, {"lang": "es", "value": "mpg321 0.2.10 permite a atacantes remotos sobreescribir memoria y posiblemente ejecutar c\u00f3digo arbitrario mediante un fichero mp3 que pasa ciertas cadenas a la funci\u00f3n printf, posiblemente disparando una vulnerabilidad de cadena de formato."}], "id": "CVE-2003-0969", "lastModified": "2024-11-20T23:45:58.970", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2004-01-20T05:00:00.000", "references": [{"source": "cve@mitre.org", "url": "http://www.debian.org/security/2004/dsa-411"}, {"source": "cve@mitre.org", "url": "http://www.novell.com/linux/security/advisories/2004_02_tcpdump.html"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/3331"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.securityfocus.com/bid/9364"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14148"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2004/dsa-411"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.novell.com/linux/security/advisories/2004_02_tcpdump.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/3331"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.securityfocus.com/bid/9364"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14148"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}