Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
MPlayer Integer Overflows in Processing ASF and AVI Headers Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1015842
|
|
SecurityTracker URL: http://securitytracker.com/id?1015842
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 29 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Version(s): 1.0.20060329 and prior versions
|
Description: A vulnerability was reported in MPlayer. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted media file that, when loaded by the target user, will trigger an integer overflow and
potentially execute arbitrary code.
The flaws reside in 'libmpdemux/asfheader.c' and 'libmpdemux/aviheader.c'.
XFOCUS Security
Team discovered this vulnerability.
|
Impact: A remote user can create a media file that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.mplayerhq.hu/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any)
|
Reported By: XFOCUS Security Team <security@xfocus.org>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 29 Mar 2006 14:12:52 +0800
From: XFOCUS Security Team <security@xfocus.org>
Subject: [Full-disclosure] [xfocus-SD-060329]MPlayer: Multiple integer
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[xfocus-SD-060329]MPlayer: Multiple integer overflows
MPlayer is a media player capable of handling multiple multimedia file
formats.
XFOCUS team (http://www.xfocus.org/) had discovered
Multiple integer overflows .Those can lead to a heap-based buffer
overflow. This could result in the execution of arbitrary code with the
permissions of the user running MPlayer.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
media-video/mplayer <= 1.0.20060329
Description
===========
[1]in libmpdemux/asfheader.c
- -----------------------------------
218 asf_scrambling_h=buffer[0];
219 asf_scrambling_w=(buffer[2]<<8)|buffer[1];
220 asf_scrambling_b=(buffer[4]<<8)|buffer[3];
221 asf_scrambling_w/=asf_scrambling_b;
char convert to int ,int value would be negative number.
this lead to asf_descrambling() heap-based buffer overflow.
[2]in libmpdemux/aviheader.c
- -----------------------------------
218 s->wLongsPerEntry = stream_read_word_le(demuxer->stream);
219 s->bIndexSubType = stream_read_char(demuxer->stream);
220 s->bIndexType = stream_read_char(demuxer->stream);
221 s->nEntriesInUse = stream_read_dword_le(demuxer->stream);
222 *(uint32_t *)s->dwChunkId =
stream_read_dword_le(demuxer->stream);
223 stream_read(demuxer->stream, (char *)s->dwReserved, 3*4);
224 memset(s->dwReserved, 0, 3*4);
225
226 print_avisuperindex_chunk(s,MSGL_V);
227
228 msize = sizeof (uint32_t) * s->wLongsPerEntry *
s->nEntriesInUse;[ERROR]
229 s->aIndex = malloc(msize);
230 memset (s->aIndex, 0, msize);
231 s->stdidx = malloc (s->nEntriesInUse * sizeof
(avistdindex_chunk));[ERROR]
232 memset (s->stdidx, 0, s->nEntriesInUse * sizeof
(avistdindex_chunk));
233
234 // now the real index of indices
235 for (i=0; i<s->nEntriesInUse; i++) {
236 chunksize-=16;
237 s->aIndex[i].qwOffset =
stream_read_dword_le(demuxer->stream) & 0xffffffff;
238 s->aIndex[i].qwOffset |=
((uint64_t)stream_read_dword_le(demuxer->stream) & 0xffffffff)<<32;
239 s->aIndex[i].dwSize =
stream_read_dword_le(demuxer->stream);
240 s->aIndex[i].dwDuration =
stream_read_dword_le(demuxer->stream);
241 mp_msg (MSGT_HEADER, MSGL_V, "ODML (%.4s): [%d]
0x%016"PRIx64" 0x%04x %u\n",
242 (s->dwChunkId), i,
243 (uint64_t)s->aIndex[i].qwOffset,
s->aIndex[i].dwSize, s->aIndex[i].dwDuration);
244 }
[ERROR] two integer overflows lead to a heap-based buffer overflow.
NOTE: aviheader.c have another potential integer overflows.
ABOUT XCON (Ad Time ;) )
========================
XCon2006 the Fifth Information Security Conference will be held
in Beijing, China, during August 18-20, 2006. ...
more at xcon2006 call for paper
http://www.xfocus.org/documents/200603/14.html
Welcome ;)
- --
Kind Regards,
- ---
XFOCUS Security Team
http://www.xfocus.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFEKiVkwhDwaF6cSWIRAppzAJ9cCFzXSN9yuU6gNqecBlGV1IaBOgCeJfGM
Vck95rxGIr86/9BZ3csUl0w=
=NdG5
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
Go to the Top of This SecurityTracker Archive Page
|
