Bug 22802 - libid3tag new security issues CVE-2004-2779, CVE-2008-2109, CVE-2017-1155[01]
Summary: libid3tag new security issues CVE-2004-2779, CVE-2008-2109, CVE-2017-1155[01]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA5TOO MGA5-64-OK MGA6-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2018-03-18 23:33 CET by David Walser
Modified: 2018-05-09 20:34 CEST (History)
7 users (show)

See Also:
Source RPM: libid3tag-0.15.1b-17.mga6.src.rpm
CVE:
Status comment:


Attachments
3 test files for 3/4 of the CVEs (81.86 KB, application/zip)
2018-04-25 13:42 CEST, Lewis Smith
Details

Description David Walser 2018-03-18 23:33:56 CET
openSUSE has issued an advisory today (March 18):
https://lists.opensuse.org/opensuse-updates/2018-03/msg00067.html

Mageia 5 and Mageia 6 are also affected.
David Walser 2018-03-18 23:34:07 CET

Whiteboard: (none) => MGA6TOO

Comment 1 Marja Van Waes 2018-03-20 13:02:57 CET
Assigning to all packagers collectively, since there is no registered maintainer for this package. CC'ing two committers.

CC: (none) => balcaen.john, cjw, marja11
Assignee: bugsquad => pkg-bugs

Comment 2 David Walser 2018-04-05 19:46:17 CEST
Fedora has issued an advisory for this today (April 5):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZK57C6F3KURSFSWNO7UZNEXO2BSEWJEK/
Comment 3 Nicolas Salguero 2018-04-20 16:13:53 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS). (CVE-2004-2779)

field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which triggers an infinite loop. (CVE-2008-2109)

The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file. (CVE-2017-11550)

The id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (OOM) via a crafted MP3 file. (CVE-2017-11551)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2779
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2109
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11550
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11551
========================

Updated package in core/updates_testing:
========================
lib(64)id3tag0-0.15.1b-17.1.mga6
lib(64)id3tag-devel-0.15.1b-17.1.mga6

from SRPMS:
libid3tag-0.15.1b-17.1.mga6.src.rpm

Version: Cauldron => 6
CC: (none) => nicolas.salguero
Whiteboard: MGA6TOO => (none)
Status: NEW => ASSIGNED
Assignee: pkg-bugs => qa-bugs
Source RPM: libid3tag-0.15.1b-18.mga7.src.rpm => libid3tag-0.15.1b-17.mga6.src.rpm

Comment 4 David Walser 2018-04-22 18:51:59 CEST
Thanks Nicolas!

Adding a Mageia 5 build too.

libid3tag0-0.15.1b-16.1.mga5
libid3tag-devel-0.15.1b-16.1.mga5

from libid3tag-0.15.1b-16.1.mga5.src.rpm

Whiteboard: (none) => MGA5TOO

Comment 5 Herman Viaene 2018-04-23 11:06:04 CEST
MGA5-32 on Dell Latitude D600 Xfce
No installation issues.
what-requires shows a.o. audacity. strace on audacity shows call to libid3tag.so.0 and audacity seems to be OK opening a .wav file.

CC: (none) => herman.viaene
Whiteboard: MGA5TOO => MGA5TOO MGA5-32-OK

Comment 6 Lewis Smith 2018-04-25 13:42:26 CEST
Created attachment 10105 [details]
3 test files for 3/4 of the CVEs

PoCs

CVE-2004-2779 no test file.
CVE-2008-2109 mp3 test file: test.mp3
 https://bugs.gentoo.org/attachment.cgi?id=143861
used with madplay.
The problem occurs when parsing an ID3_FIELD_TYPE_STRINGLIST field,
specifically when data to be parsed is ended with '\0'.
In this case, **ptr == 0, but the condition end - *ptr is 1 so loop
continues infinitely.
CVE-2017-11550 test:
 http://seclists.org/fulldisclosure/2017/Jul/att-85/poc_zip.bin
I found this bug when I test mpg321 0.3.2 which used the libid3tag library.
./mpg321 libid3tag_0.15.1b_null_pointer_dereference.mp3
Includes also file libid3tag_0.15.1b_OOM.mp3 with no usage example.
CVE-2017-11551: same as 11550.
Comment 7 Lewis Smith 2018-04-25 14:37:20 CEST
Testing M6 x64
Other programs than Audacity to try:
- moc : Console audio player for Linux/UNIX
- mpg321 : a command-line MP3 player

BEFORE update: lib64id3tag0-0.15.1b-17.mga6

Running from the directory containing the test file.
 $ mocp
 Running the server...
 Trying JACK...
 Trying ALSA...
displayed its curses interface, and played the identical jingle of each file.

 $ mpg321 libid3tag_0.15.1b_null_pointer_dereference.mp3 
High Performance MPEG 1.0/2.0/2.5 Audio Player for Layer 1, 2, and 3.
Version 0.3.2-1 (2012/03/25). Written and copyrights by Joe Drew,
now maintained by Nanakos Chrysostomos and others.
Uses code from various people. See 'README' for more!
THIS SOFTWARE COMES WITH ABSOLUTELY NO WARRANTY! USE AT YOUR OWN RISK!
Segmentation fault (core dumped)

 $ mpg321 libid3tag_0.15.1b_OOM.mp3
High Performance MPEG 1.0/2.0/2.5 Audio Player for Layer 1, 2, and 3.
Version 0.3.2-1 (2012/03/25). Written and copyrights by Joe Drew,
now maintained by Nanakos Chrysostomos and others.
Uses code from various people. See 'README' for more!
THIS SOFTWARE COMES WITH ABSOLUTELY NO WARRANTY! USE AT YOUR OWN RISK!
Title	: ExifTool Test                  Artist : Phil Harvey                   
Album	: ����������                     Year	 : 2005
Comment : My Comments                    Genre : Testing                       
Playing MPEG stream from libid3tag_0.15.1b_OOM.mp3 ...
[0:00] Decoding of libid3tag_0.15.1b_OOM.mp3 finished.
 but did not play anything.

 $ mpg321 test.mp3
Similar to above, but played the jingle.
----------------------------------------
AFTER update to: lib64id3tag0-0.15.1b-17.1.mga6.x86_64
(note sub-version jump from comment 4).
Essentially, all results same as before - good & bad.

 $ mocp
again played all 3 files OK.
 $ strace mocp 2>&1 | grep libid3tag
open("/lib64/libid3tag.so.0", O_RDONLY|O_CLOEXEC) = 3

 $ mpg321 libid3tag_0.15.1b_null_pointer_dereference.mp3
Same output as previously *including*:
Segmentation fault (core dumped)                        [Note]
 $ strace mpg321 libid3tag_0.15.1b_null_pointer_dereference.mp3 2>&1  | grep libid3tag
execve("/usr/bin/mpg321", ["mpg321", "libid3tag_0.15.1b_null_pointer_d"...], 0x7ffc6685a828 /* 73 vars */) = 0
open("/lib64/libid3tag.so.0", O_RDONLY|O_CLOEXEC) = 3
open("libid3tag_0.15.1b_null_pointer_dereference.mp3", O_RDONLY) = 3

 $ mpg321 libid3tag_0.15.1b_OOM.mp3
Same output as previously, again no sound.

 $ mpg321 test.mp3
Same output as before, again played the jingle.
 $ strace mpg321 test.mp3 2>&1 | grep libid3tag
open("/lib64/libid3tag.so.0", O_RDONLY|O_CLOEXEC) = 3

Unsure about the segfault: all one can say is 'no reversion'. Willing to OK & validate on that basis, but prefer a second opinion, hence 'feedback'.

Keywords: (none) => feedback

Comment 8 David Walser 2018-05-02 15:32:38 CEST
Sounds like CVE-2017-11550 isn't fixed from Lewis's test.
Comment 9 Nicolas Salguero 2018-05-03 11:25:13 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS). (CVE-2004-2779)

field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which triggers an infinite loop. (CVE-2008-2109)

The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file. (CVE-2017-11550)

The id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (OOM) via a crafted MP3 file. (CVE-2017-11551)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2779
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2109
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11550
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11551
========================

Updated package in 5/core/updates_testing:
========================
lib(64)id3tag0-0.15.1b-16.2.mga5
lib(64)id3tag-devel-0.15.1b-16.2.mga5

from SRPMS:
libid3tag-0.15.1b-16.2.mga5.src.rpm

Updated package in 6/core/updates_testing:
========================
lib(64)id3tag0-0.15.1b-17.2.mga6
lib(64)id3tag-devel-0.15.1b-17.2.mga6

from SRPMS:
libid3tag-0.15.1b-17.2.mga6.src.rpm

Keywords: feedback => (none)
Whiteboard: MGA5TOO MGA5-32-OK => MGA5TOO

Comment 10 David Walser 2018-05-03 15:34:34 CEST
Thanks Nicolas!  I ran Lewis's three tests with mpg321 and no segfaults or other weird behavior.  Looks good on Mageia 5 x864_64.

Whiteboard: MGA5TOO => MGA5TOO MGA5-64-OK

Comment 11 Lewis Smith 2018-05-06 09:42:59 CEST
@Nicolas
 Wanting to re-do M6/64, I cannot see lib64id3tag0-0.15.1b-17.2 in updates testing, core/nonfree/tainted enabled. Tried from MCC-Update System, and:
 # urpmi --search-media 'updates testing' lib64id3tag0
Pecyn lib64id3tag0-0.15.1b-17.1.mga6.x86_64 [already installed]

 # urpmi --search-media 'updates testing' lib64id3tag0-0.15.1b-17.2
[No package named] lib64id3tag0-0.15.1b-17.2

CC: (none) => lewyssmith

Comment 12 Nicolas Salguero 2018-05-07 10:12:12 CEST
(In reply to Lewis Smith from comment #11)
> @Nicolas
>  Wanting to re-do M6/64, I cannot see lib64id3tag0-0.15.1b-17.2 in updates
> testing, core/nonfree/tainted enabled. Tried from MCC-Update System, and:
>  # urpmi --search-media 'updates testing' lib64id3tag0
> Pecyn lib64id3tag0-0.15.1b-17.1.mga6.x86_64 [already installed]
> 
>  # urpmi --search-media 'updates testing' lib64id3tag0-0.15.1b-17.2
> [No package named] lib64id3tag0-0.15.1b-17.2

I can find those packages in some French mirrors like http://fr2.rpmfind.net
Comment 13 Lewis Smith 2018-05-08 10:20:37 CEST
Testing M6 x64
Got the new package at last: a weekend mirror problem.
 lib64id3tag0-0.15.1b-17.2.mga6
Re-running comment 7 AFTER update:

 $ mocp
played all 3 files OK.

 $ mpg321 libid3tag_0.15.1b_null_pointer_dereference.mp3
...
Title   : ExifTool Test                  Artist : Phil Harvey                   
Album   : Phil's Greatest Hits           Year    :                               
Comment :                                Genre :                               
Playing MPEG stream from libid3tag_0.15.1b_null_pointer_dereference.mp3 ...
[0:00] Decoding of libid3tag_0.15.1b_null_pointer_dereference.mp3 finished.
 No sound O/P, but no segfault, so *that* is cured.

 $ mpg321 libid3tag_0.15.1b_OOM.mp3
...
Title   : ExifTool Test                  Artist : Phil Harvey                   
Album   : ����������                     Year    : 2005
Comment : My Comments                    Genre : Testing                       
Playing MPEG stream from libid3tag_0.15.1b_OOM.mp3 ...
[0:00] Decoding of libid3tag_0.15.1b_OOM.mp3 finished.
 No sound, as per previous tests. But OK.

 $ mpg321 test.mp3
...
Title   : ��                             Artist : aiko                          
Album   : aikosingles                    Year    :                               
Comment :                                Genre : JPop                          
Playing MPEG stream from test.mp3 ...
MPEG 1.0 layer III, 128 kbit/s, 44100 Hz joint-stereo
[0:05] Decoding of test.mp3 finished.
 Played the jingle.

Update looks good. Oking, validating, advisorying.

Whiteboard: MGA5TOO MGA5-64-OK => MGA5TOO MGA5-64-OK MGA6-64-OK
Keywords: (none) => advisory, validated_update
CC: (none) => sysadmin-bugs

Comment 14 Mageia Robot 2018-05-09 20:34:02 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0223.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.