OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Daniel Kobras (kobras_at_tat.physik.uni-tuebingen.de)
Date: Wed Jan 15 2003 - 15:19:12 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Hi!

    I'd like to stress that the mpg123 exploit posted recently does not
    affect versions up to 0.59r. The vulnerable code was added as part of
    a rewrite of mpg123's prefetch. CVS checkouts after Oct. 25th, 2000
    will be affected, as is the pre0.59s development snapshot. There has
    been no stable release in that timeframe.

    The exploitable code is accompanied by the following entry to CHANGES, by
    the way:

    - major change in the stream reader: support for free format
      streams and better 'resync-on-error'. May still contain some bugs, so
      please TEST and TEST and TEST ;)

    Anyway, if you're running 0.59r, you're not vulnerable. (Well, not to
    this exploit, at least.)

    Regards,

    Daniel.

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE+JdBPpOKIA4m/fisRAkyFAJwO9XK65s6beYNmLyXd5FmRWoINuACgkCvE
    m1reXlQDdVSZVZN5uas1HFY=
    =hGiw
    -----END PGP SIGNATURE-----