Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | gstreamer-plugins-good security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2009:1123 | First vendor Publication | 2009-06-25 |
| Vendor | RedHat | Last vendor Modification | 2009-06-25 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated gstreamer-plugins-good packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: GStreamer is a streaming media framework, based on graphs of filters which operate on media data. GStreamer Good Plug-ins is a collection of well-supported, good quality GStreamer plug-ins. Multiple integer overflow flaws, that could lead to a buffer overflow, were found in the GStreamer Good Plug-ins PNG decoding handler. An attacker could create a specially-crafted PNG file that would cause an application using the GStreamer Good Plug-ins library to crash or, potentially, execute arbitrary code as the user running the application when parsed. (CVE-2009-1932) All users of gstreamer-plugins-good are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the update, all applications using GStreamer Good Plug-ins (such as some media playing applications) must be restarted for the changes to take effect. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 504199 - CVE-2009-1932 gstreamer-plugins-good: PNG decoder integer overflow |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2009-1123.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10798 | |||
| Oval ID: | oval:org.mitre.oval:def:10798 | ||
| Title: | Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow. | ||
| Description: | Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-1932 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13454 | |||
| Oval ID: | oval:org.mitre.oval:def:13454 | ||
| Title: | USN-789-1 -- gst-plugins-good0.10 vulnerability | ||
| Description: | Tielei Wang discovered that GStreamer Good Plugins did not correctly handle malformed PNG image files. If a user were tricked into opening a crafted PNG image file with a GStreamer application, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-789-1 CVE-2009-1932 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 9.04 Ubuntu 6.06 Ubuntu 8.10 | Product(s): | gst-plugins-good0.10 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13731 | |||
| Oval ID: | oval:org.mitre.oval:def:13731 | ||
| Title: | DSA-1839-1 gst-plugins-good0.10 -- integer overflow | ||
| Description: | It has been discovered that gst-plugins-good0.10, the GStreamer plugins from the "good" set, are prone to an integer overflow, when processing a large PNG file. This could lead to the execution of arbitrary code. For the stable distribution, this problem has been fixed in version 0.10.8-4.1~lenny2. For the oldstable distribution, this problem has been fixed in version 0.10.4-4+etch1. Packages for the s390 and hppa architectures will be released once they are available. For the testing distribution and the unstable distribution, this problem has been fixed in version 0.10.15-2. We recommend that you upgrade your gst-plugins-good0.10 packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1839-1 CVE-2009-1932 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | gst-plugins-good0.10 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21937 | |||
| Oval ID: | oval:org.mitre.oval:def:21937 | ||
| Title: | ELSA-2009:1123: gstreamer-plugins-good security update (Moderate) | ||
| Description: | Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2009:1123-01 CVE-2009-1932 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | gstreamer-plugins-good |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:29311 | |||
| Oval ID: | oval:org.mitre.oval:def:29311 | ||
| Title: | RHSA-2009:1123 -- gstreamer-plugins-good security update (Moderate) | ||
| Description: | Updated gstreamer-plugins-good packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. GStreamer is a streaming media framework, based on graphs of filters which operate on media data. GStreamer Good Plug-ins is a collection of well-supported, good quality GStreamer plug-ins. Multiple integer overflow flaws, that could lead to a buffer overflow, were found in the GStreamer Good Plug-ins PNG decoding handler. An attacker could create a specially-crafted PNG file that would cause an application using the GStreamer Good Plug-ins library to crash or, potentially, execute arbitrary code as the user running the application when parsed. (CVE-2009-1932) | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:1123 CESA-2009:1123-CentOS 5 CVE-2009-1932 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | gstreamer-plugins-good |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7454 | |||
| Oval ID: | oval:org.mitre.oval:def:7454 | ||
| Title: | DSA-1839 gst-plugins-good0.10 -- integer overflow | ||
| Description: | It has been discovered that gst-plugins-good0.10, the GStreamer plugins from the "good" set, are prone to an integer overflow, when processing a large PNG file. This could lead to the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1839 CVE-2009-1932 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | gst-plugins-good0.10 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for gstreamer-plugins-good CESA-2009:1123 centos5 i386 File : nvt/gb_CESA-2009_1123_gstreamer-plugins-good_centos5_i386.nasl |
| 2009-12-10 | Name : Mandriva Security Advisory MDVSA-2009:130-1 (gstreamer0.10-plugins-good) File : nvt/mdksa_2009_130_1.nasl |
| 2009-10-13 | Name : SLES10: Security update for gstreamer File : nvt/sles10_gstreamer010-pl.nasl |
| 2009-10-11 | Name : SLES11: Security update for gstreamer File : nvt/sles11_gstreamer-0_10-0.nasl |
| 2009-07-29 | Name : Debian Security Advisory DSA 1839-1 (gst-plugins-good0.10) File : nvt/deb_1839_1.nasl |
| 2009-07-29 | Name : Gentoo Security Advisory GLSA 200907-11 (gst-plugins-good gst-plugins-base gs... File : nvt/glsa_200907_11.nasl |
| 2009-06-30 | Name : RedHat Security Advisory RHSA-2009:1123 File : nvt/RHSA_2009_1123.nasl |
| 2009-06-30 | Name : CentOS Security Advisory CESA-2009:1123 (gstreamer-plugins-good) File : nvt/ovcesa2009_1123.nasl |
| 2009-06-30 | Name : Ubuntu USN-789-1 (gst-plugins-good0.10) File : nvt/ubuntu_789_1.nasl |
| 2009-06-09 | Name : Mandrake Security Advisory MDVSA-2009:130 (gstreamer0.10-plugins-good) File : nvt/mdksa_2009_130.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 54827 | GStreamer Good Plug-ins ext/libpng/gstpngdec.c PNG File Handling Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1123.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090625_gstreamer_plugins_good_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1839.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1123.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_gstreamer-0_10-plugins-good-091218.nasl - Type : ACT_GATHER_INFO |
| 2009-10-06 | Name : The remote openSUSE host is missing a security update. File : suse_gstreamer010-plugins-good-6295.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_gstreamer-0_10-plugins-good-090609.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_gstreamer010-plugins-good-6293.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_gstreamer-0_10-plugins-good-090609.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_gstreamer-0_10-plugins-good-090609.nasl - Type : ACT_GATHER_INFO |
| 2009-07-13 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200907-11.nasl - Type : ACT_GATHER_INFO |
| 2009-06-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1123.nasl - Type : ACT_GATHER_INFO |
| 2009-06-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-789-1.nasl - Type : ACT_GATHER_INFO |
| 2009-06-08 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-130.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:52:37 |
|
