Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2003-1091: MP3Broadcaster can crash or be hijacked by bad MP3 tags

CVE-2003-1091 · published 22 years ago

Summary

The MP3Broadcaster component used with Apple QuickTime/Darwin Streaming Server version 4.1.3 can be triggered by specially crafted MP3 files to stop working or run unwanted code. This happens when the server reads malformed ID3 tag information in the audio file. Apply any available updates, or restrict the server to only accept trusted MP3 files, to prevent the issue.

Original advisory text

Integer overflow in MP3Broadcaster for Apple QuickTime/Darwin Streaming Server 4.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed I...

References

http://archives.neohapsis.com/archives/bugtraq/2003-05/0245.html Exploit
http://securitytracker.com/id?1006822 Exploit
http://www.kb.cert.org/vuls/id/148564 Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/7660 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/12054

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

6% chance of attack within 30 days

Timeline

Published31 Dec 2003

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2003-1091 · NVD

Track software like this

Free during beta