Denial of Service Vulnerability in TiMidity++ Package
Summary
DEBIAN-CVE-2017-11546: The insert_note_steps function in readmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mid file. Affects timidity versions < 2.14.0-4. Fixed in 2.14.0-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TiMidity++ is a software synthesizer that converts MIDI files into audio formats. It is widely used for playing MIDI music on various platforms. The package is known for its versatility and support for multiple audio formats. However, it has been identified to have a vulnerability that allows remote attackers to exploit it through specially crafted MIDI files.
Vulnerability Detail
The vulnerability is located in the insert_note_steps function within readmidi.c of TiMidity++ version 2.14.0. It allows remote attackers to trigger a divide-by-zero error, leading to a denial of service (DoS) condition and causing the application to crash. This can be exploited by sending a maliciously crafted MIDI file to the application, which may result in service disruption, especially when the application is running in the background.
How To Fix
Minimum fixed version
2.14.0-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade timidityTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening untrusted MIDI files or running TiMidity++ with the --background option until the package is updated. This will help mitigate the risk of exploitation.
Conclusion
The TiMidity++ package has a critical vulnerability that can lead to denial of service through crafted MIDI files. Users are advised to update to the latest patched version to mitigate risks. Temporary workarounds are available until the update can be applied.
See every vulnerability recorded for timidity →
FAQ
The vulnerability is a denial of service issue caused by a divide-by-zero error in the TiMidity++ package.
If you are using TiMidity++ version 2.14.0 or earlier, your system is vulnerable. You can check your version using the command 'timidity -v'.
As a temporary measure, avoid opening untrusted MIDI files and refrain from using the application in the background.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring an account.
References
Related vulnerabilities
Recent vulnerabilities recorded for timidity.
