Vulnerable Systems:
* Libmodplug library version 0.8.8.1
Immune Systems:
* Libmodplug library version 0.8.8.2
Libmodplug library is prone to a stack based buffer overflow vulnerability due to insufficient validation of user supplied data. An attacker is able to execute arbitrary code in the context of the user when opening malicious S3M media files.
The vulnerability exists in ReadS3M method, vulnerable code is located in load_s3m.cpp (excerpt):
WORD ptr[256];
...
memset(ptr, 0, sizeof(ptr));
if (nins+npat)
{
memcpy(ptr, lpStream+dwMemPos, 2*(nins+npat));
variables nins and npat are controlled by user and are read from supplied file without any validation. These parameters directly influence the amount of data to be copied, this can be used to overflow the stack with user controlled data.
Disclosure Timeline:
2011-03-25: Contacting vendor through email
2011-04-02: Patched version released
2011-04-07: Public release
