Remote Code Execution Vulnerability in libmodplug by Open Source Community
CVE-2011-1761

Currently unrated

Key Information:

Vendor

Konstanty Bialkowski

Status
LIBModplug
Vendor
CVE Published:
7 June 2012

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 11%

What is CVE-2011-1761?

The vulnerability arises from multiple stack-based buffer overflows in the abc_new_macro and abc_new_umacro functions within the libmodplug library, prior to version 0.8.8.3. This flaw allows attackers to create specially crafted ABC files, which can lead to denial of service by crashing the application. Moreover, it opens up the possibility for remote attackers to execute arbitrary code on affected systems, posing significant risks to security and stability. Security advisories have documented this issue, highlighting the necessity for prompt updates and mitigative measures.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2011-1761 - Proof of Concept

References

http://www.debian.org/security/2012/dsa-2415
vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/44870
third-party-advisoryx_refsource_SECUNIA
http://www.osvdb.org/72157
vdb-entryx_refsource_OSVDB

EPSS Score

11% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.