Integer Overflow Vulnerabilities in libmtp
Summary
DLA-1029-1: libmtp - security update. Affects libmtp versions < 1.1.3-35-g0ece104-5+deb7u1. Fixed in 1.1.3-35-g0ece104-5+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libmtp is a library used for communicating with MTP aware devices such as cellular phones and audio players. It provides functionality to transfer files and manage media on these devices. However, versions 1.1.12 and below of libmtp were found to be vulnerable to integer overflow vulnerabilities. These vulnerabilities could be exploited by malicious devices connected via USB to cause denial of service crashes and potentially execute remote code.
Vulnerability Detail
The first vulnerability, identified as CVE-2017-9831, resides in the ptp_unpack_EOS_CustomFuncEx function of the ptp-pack.c file. It is triggered by an integer overflow and allows attackers to perform out-of-bounds memory access or potentially execute remote code by connecting a mobile device to a personal computer via USB.
The second vulnerability, known as CVE-2017-9832, exists in the ptp_unpack_OPL function of ptp-pack.c. Similar to the first vulnerability, it also involves an integer overflow and enables attackers to cause denial of service or potentially execute remote code by connecting a mobile device to a personal computer via USB.
How To Fix
Minimum fixed version
1.1.3-35-g0ece104-5+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libmtpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
libmtp versions 1.1.12 and below are vulnerable to integer overflow vulnerabilities, which can lead to denial of service crashes and potential remote code execution. To mitigate these risks, it is crucial to upgrade to libmtp version 1.1.3-35-g0ece104-5+deb7u1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libmtp →
FAQ
libmtp is a library used for communicating with MTP aware devices like cellular phones and audio players. It allows users to transfer files and manage media on these devices.
An integer overflow vulnerability occurs when an arithmetic operation results in a value that exceeds the maximum representable value for a given data type. In the case of libmtp, these vulnerabilities can lead to out-of-bounds memory access and potential remote code execution.
These vulnerabilities can be exploited by connecting a malicious mobile device to a personal computer via USB. The attacker can then trigger the integer overflow vulnerabilities in libmtp, potentially causing denial of service crashes or executing remote code.
No specific workaround has been provided for these vulnerabilities. It is recommended to update the libmtp package to the fixed version.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at the following link: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for libmtp.
