Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name MDVSA-2009:298 First vendor Publication 2009-11-13
Vendor Mandriva Last vendor Modification 2009-11-13
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerabilities have been discovered and corrected in xine-lib:

- xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via mp3 files with metadata consisting only of separators (CVE-2008-5248)

- Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow (CVE-2009-1274)

- Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a 4X movie file with a large current_track value, a similar issue to CVE-2009-0385 (CVE-2009-0698)

This update fixes these issues.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2009:298

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-189 Numeric Errors (CWE/SANS Top 25)
33 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
33 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12918
 
Oval ID: oval:org.mitre.oval:def:12918
Title: USN-734-1 -- ffmpeg, ffmpeg-debian vulnerabilities
Description: It was discovered that FFmpeg did not correctly handle certain malformed Ogg Media files. If a user were tricked into opening a crafted Ogg Media file, an attacker could cause the application using FFmpeg to crash, leading to a denial of service. It was discovered that FFmpeg did not correctly handle certain parameters when creating DTS streams. If a user were tricked into processing certain commands, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.10. It was discovered that FFmpeg did not correctly handle certain malformed DTS Coherent Acoustics files. If a user were tricked into opening a crafted DCA file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that FFmpeg did not correctly handle certain malformed 4X movie files. If a user were tricked into opening a crafted 4xm file, an attacker could execute arbitrary code with the privileges of the user invoking the program
Family: unix Class: patch
Reference(s): USN-734-1
CVE-2008-4610
CVE-2008-4866
CVE-2008-4867
CVE-2009-0385
 Version: 5
Platform(s): Ubuntu 7.10
Ubuntu 8.10
Ubuntu 8.04
 Product(s): ffmpeg
ffmpeg-debian
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13445
 
Oval ID: oval:org.mitre.oval:def:13445
Title: USN-763-1 -- xine-lib vulnerabilities
Description: It was discovered that the QT demuxer in xine-lib did not correctly handle a large count value in an STTS atom, resulting in a heap-based buffer overflow. If a user or automated system were tricked into opening a specially crafted MOV file, an attacker could execute arbitrary code as the user invoking the program. USN-746-1 provided updated xine-lib packages to fix multiple security vulnerabilities. The security patch to fix CVE-2009-0698 was incomplete. This update corrects the problem. Original advisory details: It was discovered that the 4xm demuxer in xine-lib did not correctly handle a large current_track value in a 4xm file, resulting in an integer overflow. If a user or automated system were tricked into opening a specially crafted 4xm movie file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program
Family: unix Class: patch
Reference(s): USN-763-1
CVE-2009-1274
CVE-2009-0698
 Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 6.06
Ubuntu 8.10
 Product(s): xine-lib
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13851
 
Oval ID: oval:org.mitre.oval:def:13851
Title: USN-710-1 -- xine-lib vulnerabilities
Description: It was discovered that xine-lib did not correctly handle certain malformed Ogg and Windows Media files. If a user or automated system were tricked into opening a specially crafted Ogg or Windows Media file, an attacker could cause xine-lib to crash, creating a denial of service. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that the MNG, MOD, and Real demuxers in xine-lib did not correctly handle memory allocation failures. If a user or automated system were tricked into opening a specially crafted MNG, MOD, or Real file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that the QT demuxer in xine-lib did not correctly handle an invalid metadata atom size, resulting in a heap-based buffer overflow. If a user or automated system were tricked into opening a specially crafted MOV file, an attacker could execute arbitrary code as the user invoking the program. It was discovered that the Real, RealAudio, and Matroska demuxers in xine-lib did not correctly handle malformed files, resulting in heap-based buffer overflows. If a user or automated system were tricked into opening a specially crafted Real, RealAudio, or Matroska file, an attacker could execute arbitrary code as the user invoking the program. It was discovered that the MNG and QT demuxers in xine-lib did not correctly handle malformed files, resulting in integer overflows. If a user or automated system were tricked into opening a specially crafted MNG or MOV file, an attacker could execute arbitrary code as the user invoking the program. It was discovered that the Matroska, MOD, Real, and Real Audio demuxers in xine-lib did not correctly handle malformed files, resulting in integer overflows. If a user or automated system were tricked into opening a specially crafted Matroska, MOD, Real, or Real Audio file, an attacker could execute arbitrary code as the user invoking the program. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that the input handlers in xine-lib did not correctly handle certain error codes, resulting in out-of-bounds reads and heap-based buffer overflows. If a user or automated system were tricked into opening a specially crafted file, stream, or URL, an attacker could execute arbitrary code as the user invoking the program. It was discovered that the Matroska and Real demuxers in xine-lib did not correctly handle memory allocation failures. If a user or automated system were tricked into opening a specially crafted Matroska or Real file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that the QT demuxer in xine-lib did not correctly handle an invalid metadata atom size in a compressed MOV file, resulting in an integer underflow. If a user or automated system were tricked into opening a specially crafted MOV file, an attacker could an attacker could cause xine-lib to crash, creating a denial of service. It was discovered that the Real demuxer in xine-lib did not correctly handle certain malformed files. If a user or automated system were tricked into opening a specially crafted Real file, an attacker could could cause xine-lib to crash, creating a denial of service. It was discovered that xine-lib did not correctly handle certain malformed AAC files. If a user or automated system were tricked into opening a specially crafted AAC file, an attacker could could cause xine-lib to crash, creating a denial of service. This issue only applied to Ubuntu 7.10, and 8.04 LTS. It was discovered that the id3 tag handler in xine-lib did not correctly handle malformed tags, resulting in heap-based buffer overflows. If a user or automated system were tricked into opening a media file containing a specially crafted id3 tag, an attacker could execute arbitrary code as the user invoking the program. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that xine-lib did not correctly handle MP3 files with metadata consisting only of separators. If a user or automated system were tricked into opening a specially crafted MP3 file, an attacker could could cause xine-lib to crash, creating a denial of service. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that the Matroska demuxer in xine-lib did not correctly handle an invalid track type. If a user or automated system were tricked into opening a specially crafted Matroska file, an attacker could could cause xine-lib to crash, creating a denial of service. It was discovered that the ffmpeg video decoder in xine-lib did not correctly handle media with certain image heights, resulting in a heap-based buffer overflow. If a user or automated system were tricked into opening a specially crafted video file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only applied to Ubuntu 7.10, 8.04 LTS, and 8.10. It was discovered that the ffmpeg audio decoder in xine-lib did not correctly handle malformed media, resulting in a integer overflow. If a user or automated system were tricked into opening a specially crafted media file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only applied to Ubuntu 8.10.
Family: unix Class: patch
Reference(s): USN-710-1
CVE-2008-3231
CVE-2008-5233
CVE-2008-5234
CVE-2008-5242
CVE-2008-5236
CVE-2008-5237
CVE-2008-5238
CVE-2008-5239
CVE-2008-5240
CVE-2008-5241
CVE-2008-5243
CVE-2008-5244
CVE-2008-5246
CVE-2008-5248
 Version: 5
Platform(s): Ubuntu 7.10
Ubuntu 8.04
Ubuntu 6.06
Ubuntu 8.10
 Product(s): xine-lib
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 38
Application 67
Os 3
Os 3
Os 2

OpenVAS Exploits

Date Description
2011-03-09 Name : Gentoo Security Advisory GLSA 201006-04 (xine-lib)
File : nvt/glsa_201006_04.nasl
2009-12-10 Name : Mandriva Security Advisory MDVSA-2009:319 (xine-lib)
File : nvt/mdksa_2009_319.nasl
2009-12-10 Name : Mandriva Security Advisory MDVSA-2009:297-1 (ffmpeg)
File : nvt/mdksa_2009_297_1.nasl
2009-11-17 Name : Mandriva Security Advisory MDVSA-2009:299 (xine-lib)
File : nvt/mdksa_2009_299.nasl
2009-11-17 Name : Mandriva Security Advisory MDVSA-2009:298 (xine-lib)
File : nvt/mdksa_2009_298.nasl
2009-11-17 Name : Mandriva Security Advisory MDVSA-2009:297 (ffmpeg)
File : nvt/mdksa_2009_297.nasl
2009-06-15 Name : SuSE Security Summary SUSE-SR:2009:011
File : nvt/suse_sr_2009_011.nasl
2009-06-05 Name : Ubuntu USN-763-1 (xine-lib)
File : nvt/ubuntu_763_1.nasl
2009-06-05 Name : Ubuntu USN-744-1 (lcms)
File : nvt/ubuntu_744_1.nasl
2009-06-05 Name : Ubuntu USN-743-1 (gs-gpl)
File : nvt/ubuntu_743_1.nasl
2009-05-20 Name : FreeBSD Ports: libxine
File : nvt/freebsd_libxine12.nasl
2009-05-20 Name : FreeBSD Ports: libxine
File : nvt/freebsd_libxine11.nasl
2009-05-05 Name : Debian Security Advisory DSA 1782-1 (mplayer)
File : nvt/deb_1782_1.nasl
2009-05-05 Name : Debian Security Advisory DSA 1781-1 (ffmpeg-debian)
File : nvt/deb_1781_1.nasl
2009-04-28 Name : SuSE Security Summary SUSE-SR:2009:009
File : nvt/suse_sr_2009_009.nasl
2009-04-15 Name : Fedora Core 10 FEDORA-2009-3433 (xine-lib)
File : nvt/fcore_2009_3433.nasl
2009-04-15 Name : Fedora Core 9 FEDORA-2009-3428 (xine-lib)
File : nvt/fcore_2009_3428.nasl
2009-04-06 Name : Ubuntu USN-746-1 (xine-lib)
File : nvt/ubuntu_746_1.nasl
2009-03-31 Name : Gentoo Security Advisory GLSA 200903-33 (ffmpeg gst-plugins-ffmpeg mplayer)
File : nvt/glsa_200903_33.nasl
2009-03-20 Name : FreeBSD Ports: ffmpeg
File : nvt/freebsd_ffmpeg0.nasl
2009-03-20 Name : Ubuntu USN-734-1 (ffmpeg-debian)
File : nvt/ubuntu_734_1.nasl
2009-02-18 Name : SuSE Security Summary SUSE-SR:2009:004
File : nvt/suse_sr_2009_004.nasl
2009-02-02 Name : Ubuntu USN-710-1 (xine-lib)
File : nvt/ubuntu_710_1.nasl
0000-00-00 Name : Slackware Advisory SSA:2009-098-03 xine-lib
File : nvt/esoft_slk_ssa_2009_098_03.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
53288 xine-lib STTS Quicktime Atom Handling Remote Overflow
52498 xine-lib demuxers/demux_4xm.c current_track Value Handling Overflow
51643 FFmpeg libavformat/4xm.c fourxm_read_header Function 4xm File Handling Memory...
50528 xine-lib MP3 File Metadata Handling Remote DoS

Snort® IPS/IDS

Date Description
2014-01-10 FFmpeg 4xm processing memory corruption attempt
RuleID : 15871 - Revision : 12 - Type : FILE-MULTIMEDIA

Nessus® Vulnerability Scanner

Date Description
2011-01-27 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_xine-devel-6229.nasl - Type : ACT_GATHER_INFO
2011-01-27 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_xine-devel-6050.nasl - Type : ACT_GATHER_INFO
2011-01-27 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_xine-devel-5965.nasl - Type : ACT_GATHER_INFO
2010-06-02 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201006-04.nasl - Type : ACT_GATHER_INFO
2009-12-07 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-319.nasl - Type : ACT_GATHER_INFO
2009-11-16 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-297.nasl - Type : ACT_GATHER_INFO
2009-11-16 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-299.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 11 host is missing a security update.
File : suse_11_libxine1-090507.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libxine-devel-090318.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_libxine1-090507.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_libxine-devel-090309.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_xine-devel-090507.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_xine-devel-090129.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_libxine-devel-090309.nasl - Type : ACT_GATHER_INFO
2009-05-20 Name : The remote openSUSE host is missing a security update.
File : suse_xine-devel-6230.nasl - Type : ACT_GATHER_INFO
2009-05-18 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_51d1d42842f011dead22000e35248ad7.nasl - Type : ACT_GATHER_INFO
2009-05-18 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_48e14d8642f111dead22000e35248ad7.nasl - Type : ACT_GATHER_INFO
2009-04-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1781.nasl - Type : ACT_GATHER_INFO
2009-04-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1782.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Fedora host is missing a security update.
File : fedora_2009-3433.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-710-1.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-734-1.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-746-1.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-763-1.nasl - Type : ACT_GATHER_INFO
2009-04-21 Name : The remote openSUSE host is missing a security update.
File : suse_libxine-devel-6052.nasl - Type : ACT_GATHER_INFO
2009-04-10 Name : The remote Fedora host is missing a security update.
File : fedora_2009-3428.nasl - Type : ACT_GATHER_INFO
2009-04-08 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2009-098-03.nasl - Type : ACT_GATHER_INFO
2009-03-20 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200903-33.nasl - Type : ACT_GATHER_INFO
2009-03-17 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_6733e1bf125f11dea9640030843d3802.nasl - Type : ACT_GATHER_INFO
2009-02-05 Name : The remote openSUSE host is missing a security update.
File : suse_xine-devel-5966.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2013-05-11 00:47:51
  • Multiple Updates