Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | New gst-plugins-good0.10 packages fix arbitrary code execution |
| Informations | |||
|---|---|---|---|
| Name | DSA-1839 | First vendor Publication | 2009-07-19 |
| Vendor | Debian | Last vendor Modification | 2009-07-19 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| It has been discovered that gst-plugins-good0.10, the GStreamer plugins from the "good" set, are prone to an integer overflow, when processing a large PNG file. This could lead to the execution of arbitrary code. For the stable distribution (lenny), this problem has been fixed in version 0.10.8-4.1~lenny2. For the oldstable distribution (etch), this problem has been fixed in version 0.10.4-4+etch1. Packages for the s390 and hppa architectures will be released once they are available. For the testing distribution (squeeze) and the unstable distribution (sid), this problem has been fixed in version 0.10.15-2. We recommend that you upgrade your gst-plugins-good0.10 packages. |
Original Source
| Url : http://www.debian.org/security/2009/dsa-1839 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10798 | |||
| Oval ID: | oval:org.mitre.oval:def:10798 | ||
| Title: | Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow. | ||
| Description: | Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-1932 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13454 | |||
| Oval ID: | oval:org.mitre.oval:def:13454 | ||
| Title: | USN-789-1 -- gst-plugins-good0.10 vulnerability | ||
| Description: | Tielei Wang discovered that GStreamer Good Plugins did not correctly handle malformed PNG image files. If a user were tricked into opening a crafted PNG image file with a GStreamer application, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-789-1 CVE-2009-1932 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 9.04 Ubuntu 6.06 Ubuntu 8.10 | Product(s): | gst-plugins-good0.10 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13731 | |||
| Oval ID: | oval:org.mitre.oval:def:13731 | ||
| Title: | DSA-1839-1 gst-plugins-good0.10 -- integer overflow | ||
| Description: | It has been discovered that gst-plugins-good0.10, the GStreamer plugins from the "good" set, are prone to an integer overflow, when processing a large PNG file. This could lead to the execution of arbitrary code. For the stable distribution, this problem has been fixed in version 0.10.8-4.1~lenny2. For the oldstable distribution, this problem has been fixed in version 0.10.4-4+etch1. Packages for the s390 and hppa architectures will be released once they are available. For the testing distribution and the unstable distribution, this problem has been fixed in version 0.10.15-2. We recommend that you upgrade your gst-plugins-good0.10 packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1839-1 CVE-2009-1932 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | gst-plugins-good0.10 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21937 | |||
| Oval ID: | oval:org.mitre.oval:def:21937 | ||
| Title: | ELSA-2009:1123: gstreamer-plugins-good security update (Moderate) | ||
| Description: | Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2009:1123-01 CVE-2009-1932 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | gstreamer-plugins-good |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:29311 | |||
| Oval ID: | oval:org.mitre.oval:def:29311 | ||
| Title: | RHSA-2009:1123 -- gstreamer-plugins-good security update (Moderate) | ||
| Description: | Updated gstreamer-plugins-good packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. GStreamer is a streaming media framework, based on graphs of filters which operate on media data. GStreamer Good Plug-ins is a collection of well-supported, good quality GStreamer plug-ins. Multiple integer overflow flaws, that could lead to a buffer overflow, were found in the GStreamer Good Plug-ins PNG decoding handler. An attacker could create a specially-crafted PNG file that would cause an application using the GStreamer Good Plug-ins library to crash or, potentially, execute arbitrary code as the user running the application when parsed. (CVE-2009-1932) | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:1123 CESA-2009:1123-CentOS 5 CVE-2009-1932 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | gstreamer-plugins-good |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7454 | |||
| Oval ID: | oval:org.mitre.oval:def:7454 | ||
| Title: | DSA-1839 gst-plugins-good0.10 -- integer overflow | ||
| Description: | It has been discovered that gst-plugins-good0.10, the GStreamer plugins from the "good" set, are prone to an integer overflow, when processing a large PNG file. This could lead to the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1839 CVE-2009-1932 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | gst-plugins-good0.10 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for gstreamer-plugins-good CESA-2009:1123 centos5 i386 File : nvt/gb_CESA-2009_1123_gstreamer-plugins-good_centos5_i386.nasl |
| 2009-12-10 | Name : Mandriva Security Advisory MDVSA-2009:130-1 (gstreamer0.10-plugins-good) File : nvt/mdksa_2009_130_1.nasl |
| 2009-10-13 | Name : SLES10: Security update for gstreamer File : nvt/sles10_gstreamer010-pl.nasl |
| 2009-10-11 | Name : SLES11: Security update for gstreamer File : nvt/sles11_gstreamer-0_10-0.nasl |
| 2009-07-29 | Name : Debian Security Advisory DSA 1839-1 (gst-plugins-good0.10) File : nvt/deb_1839_1.nasl |
| 2009-07-29 | Name : Gentoo Security Advisory GLSA 200907-11 (gst-plugins-good gst-plugins-base gs... File : nvt/glsa_200907_11.nasl |
| 2009-06-30 | Name : RedHat Security Advisory RHSA-2009:1123 File : nvt/RHSA_2009_1123.nasl |
| 2009-06-30 | Name : CentOS Security Advisory CESA-2009:1123 (gstreamer-plugins-good) File : nvt/ovcesa2009_1123.nasl |
| 2009-06-30 | Name : Ubuntu USN-789-1 (gst-plugins-good0.10) File : nvt/ubuntu_789_1.nasl |
| 2009-06-09 | Name : Mandrake Security Advisory MDVSA-2009:130 (gstreamer0.10-plugins-good) File : nvt/mdksa_2009_130.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 54827 | GStreamer Good Plug-ins ext/libpng/gstpngdec.c PNG File Handling Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1123.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090625_gstreamer_plugins_good_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1839.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1123.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_gstreamer-0_10-plugins-good-091218.nasl - Type : ACT_GATHER_INFO |
| 2009-10-06 | Name : The remote openSUSE host is missing a security update. File : suse_gstreamer010-plugins-good-6295.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_gstreamer-0_10-plugins-good-090609.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_gstreamer010-plugins-good-6293.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_gstreamer-0_10-plugins-good-090609.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_gstreamer-0_10-plugins-good-090609.nasl - Type : ACT_GATHER_INFO |
| 2009-07-13 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200907-11.nasl - Type : ACT_GATHER_INFO |
| 2009-06-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1123.nasl - Type : ACT_GATHER_INFO |
| 2009-06-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-789-1.nasl - Type : ACT_GATHER_INFO |
| 2009-06-08 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-130.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:28:38 |
|
