CVE:CVE-2006-3600
CNNVD:CNNVD-200607-281
TunePimp库是一个频应用开发库，允许开发人员打开音乐标签文件进行识别/查询。
libtunepimp客户端程序存在3个缓冲区溢出漏洞，由于程序中的3个栈变量分配分配了255、255和100字节，但最多却可以向其写入256个字节，攻击者可能利用此漏洞执行任意指令。
Backtrace: Thread 5 (Thread -1247491168 (LWP 13178)):
#0 0x00a4a402 in __kernel_vsyscall ()
#1 0x01b2d069 in raise () from /lib/libc.so.6
#2 0x01b2e671 in abort () from /lib/libc.so.6
#3 0x01b61a4b in __libc_message () from /lib/libc.so.6
#4 0x01be2785 in __stack_chk_fail () from /lib/libc.so.6
#5 0x03360d99 in __stack_chk_fail_local () from /usr/lib/libtunepimp.so.3
#6 0x03343135 in LookupTRM::lookup (this=0xb5a4c1e4) at lookuptools.cpp:205
#7 0x00000000 in ?? ()
solution:Upgrade libtunepimp libtunepimp to a higher version than 0.4.2,and avoid the version 0.4.2