MPlayer AVIHeader.C Heap Based Buffer Overflow Vulnerability
BID:25648
Info
MPlayer AVIHeader.C Heap Based Buffer Overflow Vulnerability
| Bugtraq ID: | 25648 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-4938 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 12 2007 12:00AM |
| Updated: | Oct 02 2007 05:29PM |
| Credit: | Code Audit Labs is credited with the discovery of this issue. |
| Vulnerable: |
MPlayer MPlayer 1.0 -rc1 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 |
| Not Vulnerable: | |
Discussion
MPlayer AVIHeader.C Heap Based Buffer Overflow Vulnerability
MPlayer is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input data.
Attackers can exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed attacks will result in denial-of-service conditions.
MPlayer 1.0rc1 is vulnerable; other versions may also be affected.
NOTE: The vendor states that this issue is present only on operating systems with a 'calloc' implementation that is prone to an integer-overflow issue.
MPlayer is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input data.
Attackers can exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed attacks will result in denial-of-service conditions.
MPlayer 1.0rc1 is vulnerable; other versions may also be affected.
NOTE: The vendor states that this issue is present only on operating systems with a 'calloc' implementation that is prone to an integer-overflow issue.
Exploit / POC
MPlayer AVIHeader.C Heap Based Buffer Overflow Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to open a maliciously crafted AVI file.
The following proof-of-concept AVI header data is available:
69 6E 64 78 00 FF FF FF 01 11 64 73 20 00 00 10
indx truck size 0xffffff00
wLongsPerEntry 0x0001
BIndexSubType is 0x64
bIndexType is 0x73
nEntriesInuse is 0x10000020
To exploit this issue, an attacker must entice an unsuspecting user to open a maliciously crafted AVI file.
The following proof-of-concept AVI header data is available:
69 6E 64 78 00 FF FF FF 01 11 64 73 20 00 00 10
indx truck size 0xffffff00
wLongsPerEntry 0x0001
BIndexSubType is 0x64
bIndexType is 0x73
nEntriesInuse is 0x10000020
Solution / Fix
MPlayer AVIHeader.C Heap Based Buffer Overflow Vulnerability
Solution:
The vendor has committed a fix to their SVN repository as of revision 24447, 13 Sept 2007. Please see the references for more information.
Solution:
The vendor has committed a fix to their SVN repository as of revision 24447, 13 Sept 2007. Please see the references for more information.
References
MPlayer AVIHeader.C Heap Based Buffer Overflow Vulnerability
References:
References:
- MPlayer Homepage (MPlayer)
- Revision 24447 (MPlayer)
- CAL-20070912-1 Multiple vendor produce handling AVI file vulnerabilities (Code Audit Labs)