Bugtraq mailing list archives
Need information, for MPlayer demux_open_vqf TwinVQ File Handling Buffer Overflow CVE-2008-5616
From: "Rajendra Prasad . Palnaty" <rajendra.palnaty () freescale com>
Date: Wed, 22 Jul 2009 14:18:15 +0530
Hi All I am in need of some Information for the below mentioned Vulnerability. CVE-2008-5616 MPlayer demux_open_vqf TwinVQ File Handling Buffer Overflow Description: MPlayer contains a stack buffer overflow vulnerability while parsing malformed TwinVQ media files, where TwinVQ (transform-domain weighted interleaved vector quantization) is an audio compression technique developed by Nippon Telegraph and Telephone Corporation (NTT). The vulnerability may be exploited by the remote attacker to execute arbitrary code in the context of MPlayer. The vulnerable function is demux_open_vqf() and the vulnerable parameters are Chunk Size of COMM chunk, and Tag Length of any tag within it. The vulnerable programs are mplayer, gmplayer and mencoder on Linux-based systems. Mplayer.exe, gmplayer.exe and mencoder.exe on Windows-based systems. This issue affects MPlayer 1.0rc2, other versions may also be affected. Vulnerability Analysis * TwinVQ (transform-domain weighted interleaved vector quantization) is an audio compression technique developed by Nippon Telegraph and Telephone Corporation (NTT). * MPlayer contains a stack buffer overflow vulnerability while parsing malformed TwinVQ media files. * TWIN constant expression for TWINVQ is always followed by 8 digits version number * COMM is the Standard Sub-chunk will fall after 4 byte size relative to TWIN pattern. * Data_size from DSIZ subchunk unsigned value is having vulnerability. * In the malicious packet i analyze, The sub-chunk size is around 8191 bytes ( 0x 00 00 1f ff). But as per the file format all these sub-chunk fields are very small. Even if all these sub-chunksare present, I didn't see that is exceed not more than say around 300-400 bytes.
So can i conclude that If the sub-chunk size is more than the above mentioned value, we can trigger an alert. Please help me out in the above mentioned issue Thanks & Regards Uthraa uthraa.c () freescale com
Current thread:
- Need information, for MPlayer demux_open_vqf TwinVQ File Handling Buffer Overflow CVE-2008-5616 Rajendra Prasad . Palnaty (Jul 22)