CVE-2017-10683

Vulnerability

In mpg123 version 1.25.0, the function convert_latin1 in libmpg123/id3.c contains a heap-based buffer over-read vulnerability. A crafted input file can cause the function to read beyond the bounds of an allocated heap buffer, as demonstrated by the proof-of-concept file POC1. The issue is reachable when mpg123 processes MPEG streams, and the heap-buffer-overflow is reported by AddressSanitizer at a READ of size 1 at an address 0 bytes to the right of a 37-byte region [1].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted MP3 file that, when processed by mpg123 (e.g., via the command $./mpg123 POC1), triggers the heap-based buffer over-read in the convert_latin1 function. No special authentication or elevated privileges are required; the attack can be carried out remotely by inducing a victim to play the malicious file. The exploit does not require user interaction beyond opening the file [1].

Impact

Successful exploitation leads to a remote denial of service attack, as the buffer over-read can cause the application to crash. The crash is due to reading invalid memory, which may also result in the disclosure of sensitive memory contents in certain configurations, but the primary impact is denial of service. No code execution or privilege escalation is described in the available references [1].

Mitigation

As of the publication date (2017-06-29), no official patch for this issue in mpg123 1.25.0 has been released. Users are advised to monitor the mpg123 project for updates and apply the fix when available. Until then, exercising caution when opening untrusted MP3 files is recommended. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [1].