Title: ABC2MTEX Process ABC Key Field Buffer Overflow Vulnerability
Severity: HIGH
Description:
abc2mtex is an application for converting ABC music notation files to MTEX format. It is available for UNIX/Linux variants and Microsoft Windows operating systems.
abc2mtex is prone to a buffer overflow vulnerability. This issue is exposed when the program is used to convert ABC notation files to MTEX format. Since the ABC files may originate from an external or untrusted source, this issue is considered remote in nature.
The specific vulnerability exists in the process_abc() function in 'abc.c'. This function performs a strcat() operation to concatenate key field data into a 99 byte buffer. The source buffer used in the operation is defined as 999 bytes in length, which will overrun the destination buffer if more than 99 bytes are copied. This will corrupt adjacent regions of memory with the superfluous data.
Successful exploitation will result in execution of arbitrary code in the context of the user running the application.
Affected Products:
- abc2mtex abc2mtex 1.6.1
References:
- "D. J. Bernstein" <djb@cr.yp.to>: [remote] [control] abc2mtex 1.6.1 process_abc overflows key buffer
- abc2mtex: abc2mtex Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
