CVE-2006-3582 - Vulnerability Details - OpenCVE

Multiple heap-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via the size specified in the package header of (1) CFF, (2) MTK, (3) DMO, and (4) U6M files.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.09029.

Key SSVC decision points have not yet been added.

Vendors	Products
Audacious Media Player Team	Adplug

Configuration 1 [-]

cpe:2.3:a:audacious_media_player_team:adplug:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://adplug.cvs.sourceforge.net/adplug/adplug/src/cff.cpp?r1=1.16&r2=1.17
http://aluigi.altervista.org/adv/adplugbof-adv.txt
http://secunia.com/advisories/20972
http://secunia.com/advisories/21238
http://secunia.com/advisories/21295
http://secunia.com/advisories/21869
http://security.gentoo.org/glsa/glsa-200607-13.xml
http://security.gentoo.org/glsa/glsa-200609-06.xml
http://www.osvdb.org/27042
http://www.osvdb.org/27043
http://www.osvdb.org/27044
http://www.osvdb.org/27047
http://www.securityfocus.com/archive/1/439432/100/100/threaded
http://www.securityfocus.com/bid/18859
http://www.vupen.com/english/advisories/2006/2697
https://exchange.xforce.ibmcloud.com/vulnerabilities/27670
https://exchange.xforce.ibmcloud.com/vulnerabilities/27677

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-07-13T19:00:00

Updated: 2024-08-07T18:30:34.522Z

Reserved: 2006-07-13T00:00:00

Link: CVE-2006-3582

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-07-13T19:05:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2006-3582

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-07-06T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple heap-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via the size specified in the package header of (1) CFF, (2) MTK, (3) DMO, and (4) U6M files."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-18T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2006-2697", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/2697"}, {"name": "adplug-dmo-file-bo(27670)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27670"}, {"name": "21238", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/21238"}, {"name": "27043", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/27043"}, {"name": "27044", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/27044"}, {"name": "adplug-u6m-file-bo(27677)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27677"}, {"name": "21295", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/21295"}, {"name": "27042", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/27042"}, {"name": "18859", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/18859"}, {"name": "27047", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/27047"}, {"name": "GLSA-200609-06", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-200609-06.xml"}, {"name": "21869", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/21869"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://adplug.cvs.sourceforge.net/adplug/adplug/src/cff.cpp?r1=1.16&r2=1.17"}, {"tags": ["x_refsource_MISC"], "url": "http://aluigi.altervista.org/adv/adplugbof-adv.txt"}, {"name": "GLSA-200607-13", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-200607-13.xml"}, {"name": "20060706 Various heap and stack overflow bugs in AdPlug library 2.0 (CVS 04 Jul 2006)", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/439432/100/100/threaded"}, {"name": "20972", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/20972"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-3582", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple heap-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via the size specified in the package header of (1) CFF, (2) MTK, (3) DMO, and (4) U6M files."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2006-2697", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/2697"}, {"name": "adplug-dmo-file-bo(27670)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27670"}, {"name": "21238", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/21238"}, {"name": "27043", "refsource": "OSVDB", "url": "http://www.osvdb.org/27043"}, {"name": "27044", "refsource": "OSVDB", "url": "http://www.osvdb.org/27044"}, {"name": "adplug-u6m-file-bo(27677)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27677"}, {"name": "21295", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/21295"}, {"name": "27042", "refsource": "OSVDB", "url": "http://www.osvdb.org/27042"}, {"name": "18859", "refsource": "BID", "url": "http://www.securityfocus.com/bid/18859"}, {"name": "27047", "refsource": "OSVDB", "url": "http://www.osvdb.org/27047"}, {"name": "GLSA-200609-06", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-200609-06.xml"}, {"name": "21869", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/21869"}, {"name": "http://adplug.cvs.sourceforge.net/adplug/adplug/src/cff.cpp?r1=1.16&r2=1.17", "refsource": "CONFIRM", "url": "http://adplug.cvs.sourceforge.net/adplug/adplug/src/cff.cpp?r1=1.16&r2=1.17"}, {"name": "http://aluigi.altervista.org/adv/adplugbof-adv.txt", "refsource": "MISC", "url": "http://aluigi.altervista.org/adv/adplugbof-adv.txt"}, {"name": "GLSA-200607-13", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-200607-13.xml"}, {"name": "20060706 Various heap and stack overflow bugs in AdPlug library 2.0 (CVS 04 Jul 2006)", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/439432/100/100/threaded"}, {"name": "20972", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/20972"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T18:30:34.522Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2006-2697", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/2697"}, {"name": "adplug-dmo-file-bo(27670)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27670"}, {"name": "21238", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/21238"}, {"name": "27043", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/27043"}, {"name": "27044", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/27044"}, {"name": "adplug-u6m-file-bo(27677)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27677"}, {"name": "21295", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/21295"}, {"name": "27042", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/27042"}, {"name": "18859", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/18859"}, {"name": "27047", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/27047"}, {"name": "GLSA-200609-06", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-200609-06.xml"}, {"name": "21869", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/21869"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://adplug.cvs.sourceforge.net/adplug/adplug/src/cff.cpp?r1=1.16&r2=1.17"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://aluigi.altervista.org/adv/adplugbof-adv.txt"}, {"name": "GLSA-200607-13", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-200607-13.xml"}, {"name": "20060706 Various heap and stack overflow bugs in AdPlug library 2.0 (CVS 04 Jul 2006)", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/439432/100/100/threaded"}, {"name": "20972", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/20972"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-3582", "datePublished": "2006-07-13T19:00:00", "dateReserved": "2006-07-13T00:00:00", "dateUpdated": "2024-08-07T18:30:34.522Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:audacious_media_player_team:adplug:*:*:*:*:*:*:*:*", "matchCriteriaId": "7913891E-426F-4DAA-9773-7BB14419D15F", "versionEndIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple heap-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via the size specified in the package header of (1) CFF, (2) MTK, (3) DMO, and (4) U6M files."}, {"lang": "es", "value": "M\u00faltiples desbordamientos de b\u00fafer basados en pila en Audacious AdPlug 2.0 y anteriores permiten a atacantes remotos con la intervenci\u00f3n de los usuarios ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s del tama\u00f1o espec\u00edfico en la cabecera del paquete de los archivos (1) CFF, (2) MTK, (3) DMO, y (4) U6M."}], "id": "CVE-2006-3582", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2006-07-13T19:05:00.000", "references": [{"source": "cve@mitre.org", "url": "http://adplug.cvs.sourceforge.net/adplug/adplug/src/cff.cpp?r1=1.16&r2=1.17"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Vendor Advisory"], "url": "http://aluigi.altervista.org/adv/adplugbof-adv.txt"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/20972"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/21238"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/21295"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/21869"}, {"source": "cve@mitre.org", "url": "http://security.gentoo.org/glsa/glsa-200607-13.xml"}, {"source": "cve@mitre.org", "url": "http://security.gentoo.org/glsa/glsa-200609-06.xml"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/27042"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/27043"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/27044"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/27047"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/439432/100/100/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/18859"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2006/2697"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27670"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27677"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://adplug.cvs.sourceforge.net/adplug/adplug/src/cff.cpp?r1=1.16&r2=1.17"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "http://aluigi.altervista.org/adv/adplugbof-adv.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/20972"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/21238"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/21295"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/21869"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://security.gentoo.org/glsa/glsa-200607-13.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://security.gentoo.org/glsa/glsa-200609-06.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/27042"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/27043"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/27044"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/27047"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/439432/100/100/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/18859"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2006/2697"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27670"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27677"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}