Debian Bug report logs - #305343
Exploitable buffer overflow in RTSP streaming code

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <muehlenhoff@univention.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Exploitable buffer overflow in RTSP streaming code

Date: Tue, 19 Apr 2005 14:25:38 +0200

Package: libxine1
Version: 1.0-1
Severity: grave
Tags: security

Two streaming related security issues have been reported in MPlayer. At least
one of them is present in xine-lib as well. The MPlayer reports can be found at
http://www.mplayerhq.hu/homepage/design7/news.html. The vulnerable MMST code
does not seem to be included in xine-lib, at least I couldn't find it.

The issue is an exploitable heap overflow in RTSP streaming (allows potential
remote execution of arbitrary code). Patch is available at
http://sourceforge.net/mailarchive/forum.php?thread_id=7060090&forum_id=11923

Stable is not affected.

Cheers,
         Moritz

-- System Information:
Debian Release: 3.0
Architecture: i386
Kernel: Linux anton 2.4.29-univention.1 #1 SMP Thu Jan 27 17:08:46 CET 2005 i686
Locale: LANG=de_DE@euro, LC_CTYPE=de_DE@euro

Versions of packages libxine1 depends on:
ii  libasound2 0.9.4-2.18.200308292050       Advanced Linux Sound Architecture 
ii  libc6      2.3.2-9                       GNU C Library: Shared libraries an
ii  libfreetyp 2.1.5-2.3.200310081510        FreeType 2 font engine, shared lib
ii  libpng12-0 1.2.5.0-8.6.200410161035      PNG library - runtime
ii  libspeex1  1.0.rel.1-2.3.200308231822    The Speex Speech Codec
ii  libxext6   4.3.0-0pre1v5.51.200409211658 X Window System miscellaneous exte
ii  xlibmesa-g 4.3.0-0pre1v5.51.200409211658 Mesa 3D graphics library [XFree86]
ii  xlibmesa-g 4.3.0-0pre1v5.51.200409211658 Mesa OpenGL utility library [XFree
ii  xlibs      4.3.0-0pre1v5.51.200409211658 X Window System client libraries m
ii  zlib1g     1:1.2.2-4.15.200501191530     compression library - runtime

-- debconf-show failed

Message #10 received at 305343@bugs.debian.org (full text, mbox, reply):

From: astharot@astharot.ath.cx (Gerardo Di Giacomo)

To: 305343@bugs.debian.org

Subject: Exploitable buffer overflow in RTSP streaming code

Date: Thu, 21 Apr 2005 02:11:21 +0200

[Message part 1 (text/plain, inline)]

Patch for sid attached.

Gerardo

[libxine1.patch (text/plain, attachment)]

Message #15 received at 305343@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: 305343@bugs.debian.org

Subject: MMST code vulnerable as well

Date: Fri, 22 Apr 2005 12:28:37 +0200

I missed the second part; the MMST code is vulnerable as well. Patch at:
http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/input/mms.c?r1=1.55&r2=1.56&diff_format=u

BTW, this is CAN-2005-1195, please refer to it when fixing it.

Cheers,
        Moritz

Message #26 received at 305343@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <martin.pitt@canonical.com>

To: 305343@bugs.debian.org

Subject: Patch

Date: Thu, 12 May 2005 09:54:26 +0200

[Message part 1 (text/plain, inline)]

Hi!

Please do not use the previous patch, since it is incomplete.

The Ubuntu patch

  http://patches.ubuntu.com/patches/xine-lib.CAN-2005-1195.patch

also fixes an overflow in the MMS stream decoder.

This is CAN-2005-1195, please mention that in the changelog.

Thanks,

Martin

-- 
Martin Pitt              http://www.piware.de
Ubuntu Developer   http://www.ubuntulinux.org
Debian Developer        http://www.debian.org

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.