MPlayer TwinVQ Handling Stack Buffer Overflow Vulnerability

Bugtraq ID:	32822
Class:	Boundary Condition Error
CVE:	CVE-2008-5616
Remote:	Yes
Local:	No
Published:	Dec 15 2008 12:00AM
Updated:	Apr 29 2009 06:56PM
Credit:	Tobias Klein
Vulnerable:	Pardus Linux 2008 0 Pardus Linux 2007 0 MPlayer MPlayer 1.0rc2 + Mandriva Linux Mandrake 2007.1 x86_64 + Mandriva Linux Mandrake 2007.1 + Mandriva Linux Mandrake 2007.0 x86_64 + Mandriva Linux Mandrake 2007.0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

MPlayer TwinVQ Handling Stack Buffer Overflow Vulnerability

MPlayer is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

This issue affects MPlayer 1.0rc2; other versions may also be affected.

MPlayer TwinVQ Handling Stack Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

The following proof of concept is available:

• /data/vulnerabilities/exploits/32822-poc.pl

MPlayer TwinVQ Handling Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 4.0 amd64

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb


• Debian mplayer_1.0~rc1-12etch7_amd64.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1 -12etch7_amd64.deb

Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva mplayer-1.0-1.rc2.10.3mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-1.0-1.rc2.10.4mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-1.0-1.rc2.10.5mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-doc-1.0-1.rc2.10.5mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-gui-1.0-1.rc2.10.5mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 ia-32

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb


• Debian mplayer_1.0~rc1-12etch7_i386.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1 -12etch7_i386.deb

Debian Linux 4.0 arm

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb


• Debian mplayer_1.0~rc1-12etch7_arm.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1 -12etch7_arm.deb

Mandriva Linux Mandrake 2008.1

• Mandriva mplayer-1.0-1.rc2.10.3mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-1.0-1.rc2.10.4mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-1.0-1.rc2.10.5mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-doc-1.0-1.rc2.10.5mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-gui-1.0-1.rc2.10.5mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 hppa

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb


• Debian mplayer_1.0~rc1-12etch7_hppa.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1 -12etch7_hppa.deb

Debian Linux 4.0 sparc

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb


• Debian mplayer_1.0~rc1-12etch7_sparc.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1 -12etch7_sparc.deb

Debian Linux 4.0 s/390

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb


• Debian mplayer_1.0~rc1-12etch7_s390.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1 -12etch7_s390.deb

Mandriva Linux Mandrake 2009.0

• Mandriva mplayer-1.0-1.rc2.18.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-1.0-1.rc2.18.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-doc-1.0-1.rc2.18.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-gui-1.0-1.rc2.18.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 powerpc

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb


• Debian mplayer_1.0~rc1-12etch7_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1 -12etch7_powerpc.deb

Debian Linux 4.0 alpha

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb


• Debian mplayer_1.0~rc1-12etch7_alpha.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1 -12etch7_alpha.deb

Debian Linux 4.0 armel

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb

Debian Linux 4.0 m68k

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb

Debian Linux 4.0

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva mplayer-1.0-1.rc2.18.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-1.0-1.rc2.18.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-doc-1.0-1.rc2.18.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-gui-1.0-1.rc2.18.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 mipsel

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva mplayer-1.0-1.rc1.20.4mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-1.0-1.rc1.20.5mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-1.0-1.rc1.20.6mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-doc-1.0-1.rc1.20.6mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-gui-1.0-1.rc1.20.6mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0

• Mandriva mplayer-1.0-1.rc1.20.4mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-1.0-1.rc1.20.5mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-1.0-1.rc1.20.6mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-doc-1.0-1.rc1.20.6mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva mplayer-gui-1.0-1.rc1.20.6mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 ia-64

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb


• Debian mplayer_1.0~rc1-12etch7_ia64.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1 -12etch7_ia64.deb

Debian Linux 4.0 mips

• Debian mplayer-doc_1.0~rc1-12etch7_all.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0 ~rc1-12etch7_all.deb


• Debian mplayer_1.0~rc1-12etch7_mips.deb
  http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1 -12etch7_mips.deb

MPlayer TwinVQ Handling Stack Buffer Overflow Vulnerability

References:

• Diff of /branches/1.0rc2/libmpdemux/demux_vqf.c (MPlayer)
  
• MPlayer Homepage (MPlayer)
  
• MPlayer TwinVQ Processing Stack Buffer Overflow Vulnerability (Tobias Klein)
  
• [TKADV2008-014] MPlayer TwinVQ Processing Stack Buffer Overflow Vulnerability (Tobias Klein )