xine-lib Bugs in Processing Media Files Lets Remote Users Deny Service and Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1020703
|
|
SecurityTracker URL: http://securitytracker.com/id?1020703
|
|
CVE Reference: CVE-2008-3231
(Links to External Site)
|
Date: Aug 15 2008
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to xine-lib 1.1.15
|
Description: A vulnerability was reported in xine-lib. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a file with a specially crafted ID3 value that, when loaded by the target user, will trigger a heap overflow
and execute arbitrary code on the target system. The code will run with the privileges of the target user.
A specially crafted
Real file may also be able to trigger a buffer overflow in the Real demuxer.
A remote user can create specially crafted media
files (e.g., Ogg format) that, when loaded by the target user, will trigger a crash [CVE-2008-3231].
|
Impact: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system or cause the target player to crash.
|
Solution: The vendor has issued a fixed version (xine-lib 1.1.15).
The vendor's advisory is available at:
http://sourceforge.net/project/shownotes.php?release_id=619869
|
Vendor URL: www.xinehq.de/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 15 Aug 2008 12:24:19 -0400
Subject: xine-lib / xine
|
http://sourceforge.net/project/shownotes.php?release_id=619869
* Security fixes:
- Fix crashes with various corrupted media files, including Ogg.
(CVE-2008-3231)
This includes a libfaad update from the 1.2 branch.
- Delay V4L video frame preallocation until we know how large they'll be.
- Fix an exploitable ID3 heap buffer overflow.
- Check for possible buffer overflow attempts in the Real demuxer.
- Use size_t for data length variables where there may be int overflows.
- Add some checks for memory allocation failures.
|
|
