Secunia Advisory: SA13547

Release Date: 2004-12-20

Critical: Moderately critical

Impact: System access

Where: From remote

Solution Status: Unpatched

Software: Ringtone Tools 2.x

Qiao Zhang has reported a vulnerability in Ringtone Tools, which can be exploited by malicious people to compromise a user’s system.

The vulnerability is caused due to a boundary error in the “parse_emelody()” function. This can be exploited to cause a buffer overflow by tricking a user into opening a specially crafted eMelody file.

Successful exploitation allows execution of arbitrary code.

The vulnerability has been reported in version 2.22. Other versions may also be affected.

Solution:
Don’t open untrusted eMelody files.