Michael Roitzsch
28/12/04, 23:05
=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
xine security announcement
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
Announcement-ID: XSA-2004-7
Summary:
A stack buffer overflow vulnerability in the AIFF demultiplexer has been fo=
und
by Ariel Berkman and was reported to the xine team by D. J. Bernstein. This=
=20
can be used for an exploit, leading to attacker-chosen code being executed=
=20
with the permissions of the user running a xine-lib based media application.
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-1300 to this issue.
Description:
AIFF is a file format supported by the xine-lib media library. During openi=
ng
and header parsing of an AIFF file, data of arbitrary length is read into an
unprotected stack buffer. This can lead to a stack overflow, which can be u=
sed
to the execution of attacker-chosen code.
An attacker can craft a malicious AIFF file and trick the user into playing=
=20
it. Since AIFF files can also be provided through network streaming, this c=
an=20
be as easy as publishing a link on a website.
It should also be noted that due to xine-lib's way of detecting file format=
s=20
by querying each available demultiplexer in turn, this problem is not limit=
ed=20
to AIFF files. The vulnerable code in the AIFF demultiplexer will also be=20
executed on non-AIFF files.
Severity:
Since the involved xine plugin is part of the standard xine installation and
the vulnerability can be used directly to write attacker-chosen code on the
stack, we consider this problem to be critical.
Affected versions:
All 1-alpha releases.
All 1-beta releases.
All 1-rc releases.
Unaffected versions:
All releases older than 1-alpha0.
1.0 or newer.
Solution:
The enclosed patch which has been applied to xine-lib CVS fixes the problem
but should only be used by distributors who do not want to upgrade.
Otherwise, we strongly advise everyone to upgrade to the 1.0 release of
xine-lib.
As a temporary workaround, you may delete the file "xineplug_dmx_audio.so"
for xine-lib versions starting with and including 1-beta3 or
"xineplug_dmx_aiff.so" for xine-lib versions older than 1-beta3 from the
xine-lib plugin directory, losing the ability to play AIFF files.
Patch:
http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/demuxers/demux_aiff=
=2Ec?r1=3D1.39&r2=3D1.40&diff_format=3Du
=46or further information and in case of questions, please contact the xine
team. Our website is http://xinehq.de/
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQFBzt8djhx3hMVnyYsRAobrAKCsmcS1aTwsKvMurvhdsZ 5lYGRNEwCff/OK
5LGNn5euSeQrIUiXA0PmWJo=3D
=3DRGD/
=2D----END PGP SIGNATURE-----
Hash: SHA1
xine security announcement
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
Announcement-ID: XSA-2004-7
Summary:
A stack buffer overflow vulnerability in the AIFF demultiplexer has been fo=
und
by Ariel Berkman and was reported to the xine team by D. J. Bernstein. This=
=20
can be used for an exploit, leading to attacker-chosen code being executed=
=20
with the permissions of the user running a xine-lib based media application.
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-1300 to this issue.
Description:
AIFF is a file format supported by the xine-lib media library. During openi=
ng
and header parsing of an AIFF file, data of arbitrary length is read into an
unprotected stack buffer. This can lead to a stack overflow, which can be u=
sed
to the execution of attacker-chosen code.
An attacker can craft a malicious AIFF file and trick the user into playing=
=20
it. Since AIFF files can also be provided through network streaming, this c=
an=20
be as easy as publishing a link on a website.
It should also be noted that due to xine-lib's way of detecting file format=
s=20
by querying each available demultiplexer in turn, this problem is not limit=
ed=20
to AIFF files. The vulnerable code in the AIFF demultiplexer will also be=20
executed on non-AIFF files.
Severity:
Since the involved xine plugin is part of the standard xine installation and
the vulnerability can be used directly to write attacker-chosen code on the
stack, we consider this problem to be critical.
Affected versions:
All 1-alpha releases.
All 1-beta releases.
All 1-rc releases.
Unaffected versions:
All releases older than 1-alpha0.
1.0 or newer.
Solution:
The enclosed patch which has been applied to xine-lib CVS fixes the problem
but should only be used by distributors who do not want to upgrade.
Otherwise, we strongly advise everyone to upgrade to the 1.0 release of
xine-lib.
As a temporary workaround, you may delete the file "xineplug_dmx_audio.so"
for xine-lib versions starting with and including 1-beta3 or
"xineplug_dmx_aiff.so" for xine-lib versions older than 1-beta3 from the
xine-lib plugin directory, losing the ability to play AIFF files.
Patch:
http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/demuxers/demux_aiff=
=2Ec?r1=3D1.39&r2=3D1.40&diff_format=3Du
=46or further information and in case of questions, please contact the xine
team. Our website is http://xinehq.de/
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQFBzt8djhx3hMVnyYsRAobrAKCsmcS1aTwsKvMurvhdsZ 5lYGRNEwCff/OK
5LGNn5euSeQrIUiXA0PmWJo=3D
=3DRGD/
=2D----END PGP SIGNATURE-----