[ GLSA 200405-24 ] MPlayer, xine-lib: vulnerabilities in RTSP stream handling

[Thierry Carrez <koon () gentoo org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200405-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: MPlayer, xine-lib: vulnerabilities in RTSP stream handling
      Date: May 28, 2004
      Bugs: #49387
        ID: 200405-24

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities, including remotely exploitable buffer
overflows, have been found in code common to MPlayer and the xine
library.

Background
==========

MPlayer is a movie player capable of handling multiple multimedia file
formats. xine-lib is a multimedia player library used by several
graphical user interfaces, including xine-ui. They both use the same
code to handle Real-Time Streaming Protocol (RTSP) streams from
RealNetworks servers.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /   Vulnerable   /                Unaffected
    -------------------------------------------------------------------
  1  media-video/mplayer      < 1.0_pre4                   >= 1.0_pre4
                                                            <= 0.92-r1
  2  media-libs/xine-lib        < 1_rc4                       >= 1_rc4
                                                          <= 0.9.13-r3

Description
===========

Multiple vulnerabilities have been found and fixed in the RTSP handling
code common to recent versions of these two packages. These
vulnerabilities include several remotely exploitable buffer overflows.

Impact
======

A remote attacker, posing as a RTSP stream server, can execute
arbitrary code with the rights of the user of the software playing the
stream (MPlayer or any player using xine-lib). Another attacker may
entice a user to use a maliciously crafted URL or playlist to achieve
the same results.

Workaround
==========

For MPlayer, there is no known workaround at this time. For xine-lib,
you can delete the xineplug_inp_rtsp.so file.

Resolution
==========

All users should upgrade to non-vulnerable versions of MPlayer and
xine-lib:

    # emerge sync

    # emerge -pv ">=media-video/mplayer-1.0_pre4"
    # emerge ">=media-video/mplayer-1.0_pre4"

    # emerge -pv ">=media-libs/xine-lib-1_rc4"
    # emerge ">=media-libs/xine-lib-1_rc4"

References
==========

  [ 1 ] Xine security advisory
        http://xinehq.de/index.php/security/XSA-2004-3
  [ 2 ] CAN-2004-0433
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0433

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

     http://security.gentoo.org/glsa/glsa-200405-24.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Technologies, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAt3XnvcL1obalX08RAh2gAJ9ySSipEhhDmj6aBHaMIrGCvhal5QCfft/d
4esLZpJjqX0f+8HpE4uzyi0=
=jm1a
-----END PGP SIGNATURE-----