xine and MPlayer PNA_TAG buffer overflow

xine-pnatag-bo (18640) The risk level is classified as HighHigh Risk

Description:

xine is vulnerable to a buffer overflow, caused by improper bounds checking by the code that handles the PNA_TAG value in the pnm_get_chunk function. A remote attacker, in control of a malicious PNM server, could create specially-crafted data to overflow a buffer and execute arbitrary code on the system with privileges of the user, once the malicious data is requested.

Note: MPlayer versions prior to 1.0pre5try2 are also affected by this vulnerability.


Consequences:

Gain Access

Remedy:

For xine:
Upgrade to the latest version of xine (1-rc8 or later), available from the xine Download Web page. See References.

For MPlayer:
Upgrade to the latest version of MPlayer (1.0pre5try2 or later), available from the MPlayer Download Web page. See References.

For Ubuntu Linux:
Upgrade to the latest libxine1 package (1-rc5-1ubuntu2.1 or later), as listed in USN-8-1 October 27, 2004 for more information. See References.

For Mandrake Linux:
Upgrade to the latest xine-lib package as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2005:011 for more information. See References.

Mandrake Linux 10.0: 1-0.rc3.6.3.100mdk or later
Mandrake Linux 10.1: 1-0.rc5.9.1.101mdk or later

For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2005-01-07 for patch, upgrade, or suggested workaround information. See References.

For other distributions:
Contact your vendor for upgrade or patch information.

References:

  • iDEFENSE Security Advisory 12.21.04: Multiple Vendor Xine 0.99.2 PNM Handler PNA_TAG Heap Overflow Vulnerability.
  • MPlayer Download Web page: Mplayer - The Movie Player for Linux.
  • xine Web site: xine - A Free Video Player.
  • BID-11987: MPlayer And Xine-Lib Multiple Remote Client-Side Buffer Overflow Vulnerabilities
  • BID-12076: MPlayer And Xine PNM_Get_Chunk Multiple Remote Client-Side Buffer Overflow Vulnerabilities
  • CVE-2004-1187: Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNA_TAG values, a different vulnerability than CVE-2004-1188.
  • GLSA-200501-07: xine-lib: Multiple overflows
  • MDKSA-2005:011: Updated xine packages fix multiple vulnerabilities
  • SUSE-SR:2005:002: SUSE Security Summary Report

Platforms Affected:

  • Canonical Ubuntu 4.10
  • Gentoo Linux
  • MandrakeSoft Mandrake Linux 10.0
  • MandrakeSoft Mandrake Linux 10.0 AMD64
  • MandrakeSoft Mandrake Linux 10.1
  • MandrakeSoft Mandrake Linux 10.1 X86_64
  • MPlayer MPlayer prior to 1.0 pre5try2
  • Turbolinux Turbolinux 10 Desktop
  • Turbolinux Turbolinux 10 F...
  • Turbolinux Turbolinux Home
  • Xine xine 0.99.2

Reported:

Dec 21, 2004

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page