xine and MPlayer PNA_TAG buffer overflow
| xine-pnatag-bo (18640) |  High Risk |
Description:
xine is vulnerable to a buffer overflow, caused by improper bounds checking by the code that handles the PNA_TAG value in the pnm_get_chunk function. A remote attacker, in control of a malicious PNM server, could create specially-crafted data to overflow a buffer and execute arbitrary code on the system with privileges of the user, once the malicious data is requested.
Note: MPlayer versions prior to 1.0pre5try2 are also affected by this vulnerability.
Platforms Affected:
- Canonical, Ubuntu 4.10
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 10.1
- MandrakeSoft, Mandrake Linux 10.1 X86_64
- MPlayer, MPlayer prior to 1.0 pre5try2
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux Home
- Xine, xine 0.99.2
Remedy:
For xine:
Upgrade to the latest version of xine (1-rc8 or later), available from the xine Download Web page. See References.
For MPlayer:
Upgrade to the latest version of MPlayer (1.0pre5try2 or later), available from the MPlayer Download Web page. See References.
For Ubuntu Linux:
Upgrade to the latest libxine1 package (1-rc5-1ubuntu2.1 or later), as listed in USN-8-1 October 27, 2004 for more information. See References.
For Mandrake Linux:
Upgrade to the latest xine-lib package as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2005:011 for more information. See References.
Mandrake Linux 10.0: 1-0.rc3.6.3.100mdk or later
Mandrake Linux 10.1: 1-0.rc5.9.1.101mdk or later
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2005-01-07 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- iDEFENSE Security Advisory 12.21.04, Multiple Vendor Xine 0.99.2 PNM Handler PNA_TAG Heap Overflow Vulnerability at http://www.idefense.com/application/poi/display?id=176&type=vulnerabilities.
- MPlayer Download Web page, Mplayer - The Movie Player for Linux at http://www.mplayerhq.hu/homepage/design6/dload.html.
- xine Web site, xine - A Free Video Player at http://xinehq.de/.
- BID-11987: MPlayer And Xine-Lib Multiple Remote Client-Side Buffer Overflow Vulnerabilities
- BID-12076: MPlayer And Xine PNM_Get_Chunk Multiple Remote Client-Side Buffer Overflow Vulnerabilities
- CVE-2004-1187: Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNA_TAG values, a different vulnerability than CVE-2004-1188.
- GLSA-200501-07: xine-lib: Multiple overflows
- MDKSA-2005:011: Updated xine packages fix multiple vulnerabilities
- SUSE-SR:2005:002: SUSE Security Summary Report
Reported:
Dec 21, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net