Remote Denial of Service in Xiph.Org libao MP3 Processing
CVE-2017-11548

5.5MEDIUM

Key Information:

Vendor

Xiph

Status
Libao
Vendor
CVE Published:
31 July 2017

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2017-11548?

The _tokenize_matrix function in audio_out.c of Xiph.Org libao 1.2.0 is susceptible to remote exploitation, leading to potential memory corruption. Attackers can craft a malicious MP3 file that triggers a denial of service when processed, affecting system stability and availability. This vulnerability underscores the importance of validating input data in media processing applications to mitigate the risks associated with malformed files.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2017-11548 - Proof of Concept

References

http://seclists.org/fulldisclosure/2017/Jul/84
x_refsource_MISC
https://www.exploit-db.com/exploits/42400/
exploitx_refsource_EXPLOIT-DB

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.