Ubuntu
xine-lib package

[xine-lib] [CVE-2008-0225] insufficient input sanitising during the handling of RTSP streams

Bug #185034 reported by disabled.user
258
Affects Status Importance Assigned to Milestone
xine-lib (Gentoo Linux)
Fix Released
Medium
xine-lib (Ubuntu)
Invalid
Undecided
Unassigned
Dapper
Fix Released
Undecided
Unassigned
Feisty
Fix Released
Undecided
Unassigned
Gutsy
Fix Released
Undecided
Jamie Strandboge

Bug Description

References:
DSA-1472-1 (http://www.debian.org/security/2008/dsa-1472)

Quoting:
"Luigi Auriemma discovered that the Xine media player library performed
insufficient input sanitising during the handling of RTSP streams,
which could lead to the execution of arbitrary code."

CVE References

Revision history for this message
In , lars (lars-chaotika) wrote :

The vulnerabilities are caused due to boundary errors within the "rmff_dump_cont()" function in input/libreal/rmff.c when processing the SDP "Title", "Author", Copyright", and "Abstract" attributes. These can be exploited to cause a heap-based buffer overflow by tricking the user into connecting to a malicious RTSP server.

Successful exploitation may allow execution of arbitrary code.

The vulnerabilities are confirmed in version 1.1.9. Other versions may also be affected.

Solution: no upstream fix avaible, so "Do not connect to untrusted streaming servers."...

Revision history for this message
In , Robert Buchholz (rbu) wrote :

Media-video, please advise.

Revision history for this message
In , Aballier (aballier) wrote :

xine-lib 1.1.9.1 is in the tree and candidate for stable, see changelog why there is a -r1 too...

Revision history for this message
In , Jaervosz (jaervosz) wrote :

Arches please test and mark stable. Target keywords are:

xine-lib-1.1.9.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 ~x86-fbsd"

Revision history for this message
In , Ranger-z (ranger-z) wrote :

ppc64 done

Revision history for this message
In , Dertobi123 (dertobi123) wrote :

(In reply to comment #3)
> Arches please test and mark stable. Target keywords are:
>
> xine-lib-1.1.9.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
> ~x86-fbsd"
>

which should be 1.1.9.1 according to the changelog, re-adding ppc64

xine-lib-1.1.9.1.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 ~x86-fbsd"

Revision history for this message
In , Ranger-z (ranger-z) wrote :

1.1.9.1 done now too. ppc64 stable

Revision history for this message
In , Dertobi123 (dertobi123) wrote :

ppc stable

Revision history for this message
In , Maekke-gentoo (maekke-gentoo) wrote :

x86 stable

Revision history for this message
In , Jeroen Roovers (jer-gentoo) wrote :

Stable for HPPA.

Revision history for this message
In , Raúl Porcel (armin76) wrote :

alpha/ia64/sparc stable

Revision history for this message
In , Welp (welp) wrote :

amd64 done.

Revision history for this message
In , Jaervosz (jaervosz) wrote :

GLSA request filed.

Revision history for this message
disabled.user (disabled.user-deactivatedaccount) wrote :

See also:
MDVSA-2008:020 (http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:020)

Quoting:
"Heap-based buffer overflow in the rmff_dump_cont function in
input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote
attackers to execute arbitrary code via the SDP Abstract attribute,
related to the rmff_dump_header function and related to disregarding
the max field. (CVE-2008-0225)

Multiple heap-based buffer overflows in the rmff_dump_cont function
in input/libreal/rmff.c in xine-lib 1.1.9 allow remote attackers
to execute arbitrary code via the SDP (1) Title, (2) Author, or
(3) Copyright attribute, related to the rmff_dump_header function,
different vectors than CVE-2008-0225. (CVE-2008-0238)"

Revision history for this message
In , Robert Buchholz (rbu) wrote :

GLSA 200801-12, thanks.

Revision history for this message
disabled.user (disabled.user-deactivatedaccount) wrote :

Any news on those security updates for xine-lib?

Bug Watch Updater (bug-watch-updater)
Changed in xine-lib:
status: Unknown → Fix Released
Jamie Strandboge (jdstrand)
Changed in xine-lib:
status: New → Invalid
status: New → Fix Released
status: New → Fix Released
assignee: nobody → jdstrand
status: New → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in xine-lib (Gentoo Linux):
importance: Unknown → Medium
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.