Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
NameMDVSA-2011:061First vendor Publication2011-04-01
VendorMandrivaLast vendor Modification2011-04-01
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score10Attack RangeNetwork
Cvss Impact Score10Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple vulnerabilities has been identified and fixed in ffmpeg:

oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read. (CVE-2009-4632)

vorbis_dec.c in FFmpeg 0.5 uses an assignment operator when a comparison operator was intended, which might allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that modifies a loop counter and triggers a heap-based buffer overflow. (CVE-2009-4633)

Multiple integer underflows in FFmpeg 0.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that (1) bypasses a validation check in vorbis_dec.c and triggers a wraparound of the stack pointer, or (2) access a pointer from out-of-bounds memory in mov.c, related to an elst tag that appears before a tag that creates a stream. (CVE-2009-4634)

FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags that cause (1) mov.c and (2) utils.c to use inconsistent codec types and identifiers, which causes the mp3 decoder to process a pointer for a video structure, leading to a stack-based buffer overflow. (CVE-2009-4635)

FFmpeg 0.5 allows remote attackers to cause a denial of service (hang) via a crafted file that triggers an infinite loop. (CVE-2009-4636)

The av_rescale_rnd function in the AVI demuxer in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) via a crafted AVI file that triggers a divide-by-zero error. (CVE-2009-4639)

Array index error in vorbis_dec.c in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Vorbis file that triggers an out-of-bounds read. (CVE-2009-4640)

flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used in MPlayer and other products, allows remote attackers to execute arbitrary code via a crafted flic file, related to an arbitrary offset dereference vulnerability. (CVE-2010-3429)

Fix memory corruption in WMV parsing (CVE-2010-3908)

libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted .ogg file, related to the vorbis_floor0_decode function. (CVE-2010-4704)

Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted WebM file, related to buffers for (1) the channel floor and (2) the channel residue. (CVE-2011-0480)

Fix heap corruption crashes (CVE-2011-0722)

Fix invalid reads in VC-1 decoding (CVE-2011-0723)

And several additional vulnerabilites originally discovered by Google Chrome developers were also fixed with this advisory.

The updated packages have been patched to correct these issues.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2011:061

CWE : Common Weakness Enumeration

idName
CWE-189Numeric Errors (CWE/SANS Top 25)
CWE-119Failure to Constrain Operations within the Bounds of a Memory Buffer
CWE-94Failure to Control Generation of Code ('Code Injection')
CWE-399Resource Management Errors
CWE-20Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:7021
 
Oval ID: oval:org.mitre.oval:def:7021
Title: DSA-2000 ffmpeg-debian -- several vulnerabilities
Description: Several vulnerabilities have been discovered in ffmpeg, a multimedia player, server and encoder, which also provides a range of multimedia libraries used in applications like MPlayer: Various programming errors in container and codec implementations may lead to denial of service or the execution of arbitrary code if the user is tricked into opening a malformed media file or stream. The implementations of the following affected codecs and container formats have been updated:
Family: unix Class: patch
Reference(s): DSA-2000
CVE-2009-4631
CVE-2009-4632
CVE-2009-4633
CVE-2009-4634
CVE-2009-4635
CVE-2009-4636
CVE-2009-4637
CVE-2009-4638
CVE-2009-4640
Version: 5
Platform(s): Debian GNU/Linux 5.0
Product(s): ffmpeg-debian
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13249
 
Oval ID: oval:org.mitre.oval:def:13249
Title: USN-931-1 -- ffmpeg, ffmpeg-debian vulnerabilities
Description: It was discovered that FFmpeg contained multiple security issues when handling certain multimedia files. If a user were tricked into opening a crafted multimedia file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program.
Family: unix Class: patch
Reference(s): USN-931-1
CVE-2009-4632
CVE-2009-4633
CVE-2009-4634
CVE-2009-4635
CVE-2009-4637
CVE-2009-4639
CVE-2009-4640
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 8.10
Ubuntu 9.10
Ubuntu 9.04
Product(s): ffmpeg
ffmpeg-debian
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13112
 
Oval ID: oval:org.mitre.oval:def:13112
Title: DSA-2000-1 ffmpeg-debian -- several
Description: Several vulnerabilities have been discovered in ffmpeg, a multimedia player, server and encoder, which also provides a range of multimedia libraries used in applications like MPlayer: Various programming errors in container and codec implementations may lead to denial of service or the execution of arbitrary code if the user is tricked into opening a malformed media file or stream. Affected and updated have been the implementations of the following codecs and container formats: - - the Vorbis audio codec - - the Ogg container implementation - - the FF Video 1 codec - - the MPEG audio codec - - the H264 video codec - - the MOV container implementation - - the Oggedc container implementation For the stable distribution, these problems have been fixed in version 0.svn20080206-18+lenny1. For the unstable distribution, these problems have been fixed in version 4:0.5+svn20090706-5. We recommend that you upgrade your ffmpeg packages.
Family: unix Class: patch
Reference(s): DSA-2000-1
CVE-2009-4631
CVE-2009-4632
CVE-2009-4633
CVE-2009-4634
CVE-2009-4635
CVE-2009-4636
CVE-2009-4637
CVE-2009-4638
CVE-2009-4640
Version: 5
Platform(s): Debian GNU/Linux 5.0
Product(s): ffmpeg-debian
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:14380
 
Oval ID: oval:org.mitre.oval:def:14380
Title: Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted WebM file, related to buffers for (1) the channel floor and (2) the channel residue.
Description: Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted WebM file, related to buffers for (1) the channel floor and (2) the channel residue.
Family: windows Class: vulnerability
Reference(s): CVE-2011-0480
Version: 15
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Product(s): Google Chrome
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15128
 
Oval ID: oval:org.mitre.oval:def:15128
Title: DSA-2306-1 ffmpeg -- several
Description: Several vulnerabilities have been discovered in ffmpeg, a multimedia player, server and encoder. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2010-3908 FFmpeg before 0.5.4, allows remote attackers to cause a denial of service or possibly execute arbitrary code via a malformed WMV file. CVE-2010-4704 libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg allows remote attackers to cause a denial of service via a crafted .ogg file, related to the vorbis_floor0_decode function. CVE-2011-0480 Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted WebM file, related to buffers for the channel floor and the channel residue. CVE-2011-0722 FFmpeg allows remote attackers to cause a denial of service or possibly execute arbitrary code via a malformed RealMedia file.
Family: unix Class: patch
Reference(s): DSA-2306-1
CVE-2010-3908
CVE-2010-4704
CVE-2011-0480
CVE-2011-0722
CVE-2011-0723
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): ffmpeg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13661
 
Oval ID: oval:org.mitre.oval:def:13661
Title: USN-1104-1 -- ffmpeg vulnerabilities
Description: Cesar Bernardini and Felipe Andres Manzano discovered that FFmpeg incorrectly handled certain malformed flic files. If a user were tricked into opening a crafted flic file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. Dan Rosenberg discovered that FFmpeg incorrectly handled certain malformed wmv files. If a user were tricked into opening a crafted wmv file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. It was discovered that FFmpeg incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that FFmpeg incorrectly handled certain malformed WebM files. If a user were tricked into opening a crafted WebM file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Dan Rosenberg discovered that FFmpeg incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted RealMedia file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. Dan Rosenberg discovered that FFmpeg incorrectly handled certain malformed VC1 files. If a user were tricked into opening a crafted VC1 file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program
Family: unix Class: patch
Reference(s): USN-1104-1
CVE-2010-3429
CVE-2010-3908
CVE-2010-4704
CVE-2011-0480
CVE-2011-0722
CVE-2011-0723
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 10.10
Ubuntu 9.10
Ubuntu 10.04
Product(s): ffmpeg
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application21
Application1
Application873
Application1
Application93
Os1
Os1
Os1
Os3

OpenVAS Exploits

DateDescription
2011-09-21Name : Debian Security Advisory DSA 2306-1 (ffmpeg)
File : nvt/deb_2306_1.nasl
2011-07-22Name : Mandriva Update for blender MDVSA-2011:112 (blender)
File : nvt/gb_mandriva_MDVSA_2011_112.nasl
2011-07-22Name : Mandriva Update for blender MDVSA-2011:114 (blender)
File : nvt/gb_mandriva_MDVSA_2011_114.nasl
2011-05-17Name : Mandriva Update for mplayer MDVSA-2011:088 (mplayer)
File : nvt/gb_mandriva_MDVSA_2011_088.nasl
2011-05-17Name : Mandriva Update for mplayer MDVSA-2011:089 (mplayer)
File : nvt/gb_mandriva_MDVSA_2011_089.nasl
2011-04-06Name : Mandriva Update for ffmpeg MDVSA-2011:060 (ffmpeg)
File : nvt/gb_mandriva_MDVSA_2011_060.nasl
2011-04-06Name : Mandriva Update for ffmpeg MDVSA-2011:061 (ffmpeg)
File : nvt/gb_mandriva_MDVSA_2011_061.nasl
2011-04-06Name : Mandriva Update for ffmpeg MDVSA-2011:062 (ffmpeg)
File : nvt/gb_mandriva_MDVSA_2011_062.nasl
2011-04-06Name : Ubuntu Update for ffmpeg vulnerabilities USN-1104-1
File : nvt/gb_ubuntu_USN_1104_1.nasl
2011-03-07Name : Debian Security Advisory DSA 2165-1 (ffmpeg-debian)
File : nvt/deb_2165_1.nasl
2011-01-27Name : Google Chrome multiple vulnerabilities - Jan11 (Linux)
File : nvt/gb_google_chrome_mult_vuln_jan11_lin.nasl
2011-01-27Name : Google Chrome multiple vulnerabilities - Jan11 (Windows)
File : nvt/gb_google_chrome_mult_vuln_jan11_win.nasl
2010-04-29Name : Ubuntu Update for ffmpeg, ffmpeg-debian vulnerabilities USN-931-1
File : nvt/gb_ubuntu_USN_931_1.nasl
2010-02-25Name : Debian Security Advisory DSA 2000-1 (ffmpeg-debian)
File : nvt/deb_2000_1.nasl
2010-02-17Name : FFmpeg multiple vulnerabilities (Linux)
File : nvt/gb_ffmpeg_mult_vuln_lin.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
74020FFmpeg on Mandriva Multiple Unspecified Issues
72579FFmpeg Malformed WMV File Handling Memory Corruption
72578FFmpeg RealMedia File Handling Memory Corruption DoS
72574FFmpeg Malformed VC-1 File Handling DoS
70650FFmpeg Vorbis Decoder libavcodec/vorbis_dec.c vorbis_floor0_decode Function O...
70463FFmpeg Vorbis Decoder vorbis_dec.c WebM File Handling Multiple Overflow DoS
68269FFmpeg libavcodec/flicvideo.c Multiple Function Array Indexing Memory Corruption
62328FFmpeg vorbis_dec.c Array Index Error Out-of-bounds Read Remote DoS
62327FFmpeg mov.c Out-of-bounds Memory Pointer Underflow
58510FFmpeg AVI Demuxer av_rescale_rnd Function Divide-by-zero DoS
58508FFmpeg Unspecified Crafted File Infinite Loop DoS
58507FFmpeg Multiple File MOV Container Handling Overflow
58506FFmpeg vorbis_dec.c Validation Check Underflow
58505FFmpeg vorbis_dec.c Assignment Operator Remote Overflow DoS
58504FFmpeg oggparsevorbis.c Out-of-bounds Read Remote DoS

Snort® IPS/IDS

DateDescription
2014-01-10Google Chrome Uninitialized bug_report Pointer Code Execution
RuleID : 19217 - Revision : 9 - Type : BROWSER-CHROME
2014-01-10Google Chrome Uninitialized bug_report Pointer Code Execution
RuleID : 19216 - Revision : 9 - Type : BROWSER-CHROME
2014-01-10FFmpeg OGV file format memory corruption attempt
RuleID : 16353 - Revision : 9 - Type : FILE-MULTIMEDIA

Nessus® Vulnerability Scanner

DateDescription
2013-10-27Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201310-12.nasl - Type : ACT_GATHER_INFO
2013-10-27Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201310-13.nasl - Type : ACT_GATHER_INFO
2011-09-12Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2306.nasl - Type : ACT_GATHER_INFO
2011-07-19Name : The remote Mandriva Linux host is missing a security update.
File : mandriva_MDVSA-2011-112.nasl - Type : ACT_GATHER_INFO
2011-07-19Name : The remote Mandriva Linux host is missing a security update.
File : mandriva_MDVSA-2011-114.nasl - Type : ACT_GATHER_INFO
2011-05-17Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2011-088.nasl - Type : ACT_GATHER_INFO
2011-05-17Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2011-089.nasl - Type : ACT_GATHER_INFO
2011-04-05Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1104-1.nasl - Type : ACT_GATHER_INFO
2011-04-04Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2011-060.nasl - Type : ACT_GATHER_INFO
2011-04-04Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2011-061.nasl - Type : ACT_GATHER_INFO
2011-04-04Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2011-062.nasl - Type : ACT_GATHER_INFO
2011-02-20Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2165.nasl - Type : ACT_GATHER_INFO
2011-01-13Name : The remote host contains a web browser that is affected by multiple vulnerabi...
File : google_chrome_8_0_552_237.nasl - Type : ACT_GATHER_INFO
2010-04-20Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-931-1.nasl - Type : ACT_GATHER_INFO
2010-02-24Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2000.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 11:42:09
  • Multiple Updates