April 2004 - MPlayer-announce - lists.mplayerhq.hu

[SECURITY] remotely exploitable buffer overflow in the Real RTSP code found
by Diego Biurrun 29 Apr '04

29 Apr '04

________ Summary: ~~~~~~~~ Multiple vulnerabilities have being found and fixed in the Real-Time Streaming Protocol (RTSP) client for RealNetworks servers, including a series of potentially remotely exploitable buffer overflows. This is a joint advisory by the MPlayer and xine teams as the code in question is common to these projects. The xine team has assigned ID XSA-2004-3 to this security announcement. _________ Severity: ~~~~~~~~~ High (arbitrary remote code execution under the user ID running the player) when playing Real RTSP streams. At this time, there is no known exploit for these vulnerabilities. ______________ Prerequisites: ~~~~~~~~~~~~~~ The players are only vulnerable when playing Real RTSP streams. There is no risk if Real RTSP (realrtsp) streaming is not employed. _________ Solution: ~~~~~~~~~ A fix was checked into MPlayer CVS on Sat, 24 Apr 2004 12:33:22 +0200 (CEST). This fix is included in MPlayer 1.0pre4. Users of affected MPlayer versions should upgrade to MPlayer 1.0pre4 or later. xine-lib fix was checked into CVS on Fri, Apr 23 21:59:04 2004 UTC. This fix is included in xine-lib 1-rc4. Users of affected xine-lib versions should upgrade to xine-lib 1-rc4 or later. If this upgrade is not feasible for some reason, the vulnerable code can be disabled by removing xine's RTSP input plugin, which is located at $(xine-config --plugindir)/xineplug_inp_rtsp.so). If installed with default paths, that is: /usr/local/lib/xine/plugins/1.0.0/xineplug_inp_rtsp.so This workaround disables RTSP streaming. __________________ Affected versions: ------------------ MPlayer 1.0pre1-pre3try2 xine-lib 1-beta1 to 1-rc3c ____________________ Unaffected versions: -------------------- MPlayer 0.92.1 and below MPlayer 1.0pre4 and above MPlayer CVS HEAD xine-lib 1-beta0 and below xine-lib 1-rc4 and above xine-lib CVS HEAD _________________________ History / Attack Vectors: ~~~~~~~~~~~~~~~~~~~~~~~~~ On Thu, 22 Apr 2004 Diego Biurrun found a crashing bug in the MPlayer realrtsp code that Roberto Togni confirmed to be a buffer overflow vulnerability later that day. The xine team was notified and independent code audits were performed by Miguel Freitas (xine) and Roberto Togni (MPlayer), revealing multiple vulnerabilities. 1) Fixed length buffers were assigned for the URL used in server requests and the length of the input was never checked. Very long URLs could thus overflow these buffers and crash the application. A malicious person might possibly use a specially crafted URL or playlist to run arbitrary code on the user's machine. 2) Not all strings returned from a Real server were checked for length. It might be possible to cause a buffer overflow during the RTSP session negotiation sequence. A malicious person could use a fake RTSP server to feed the client with malformed strings. 3) Packets of RealNetworks' Real Data Transport (RDT) format were received using a fixed length buffer whose size was never checked. It might also be possible to exploit this by emulating a RealNetworks' RTSP server. On Wed, 14 Apr 2004 22:45:28 +0200 (CEST) a change was made to MPlayer CVS that removes the extension checking on RTSP streams. MPlayer now attempts to handle every RTSP connection as realrtsp first, falling back to live.com RTSP. CVS versions from that date to the time the fix was checked in are susceptible to the same problem when playing normal RTSP streams as well. At the time of the writing of this advisory no real exploits are known to the authors and we hope to be the first to stumble across this vulnerability. Since we believe that the bugs described in this advisory are exploitable we have released this proactive advisory. _________ Download: ~~~~~~~~~ MPlayer 1.0pre4 can be downloaded from the MPlayer homepage or one of its many mirrors. Go to the MPlayer download page at http://www.mplayerhq.hu/homepage/dload.html to get MPlayer 1.0pre4 source code. xine-lib 1-rc4 can be downloaded from the xine homepage at http://xinehq.de/index.php/releases

1 0

[ANNOUNCE] MPlayer 1.0pre4 out
by Alex Beregszaszi 28 Apr '04

28 Apr '04

Hi, I'm proud to announce that 1.0pre4 is released. Just visit the homepage and grab it! The DLL codec pack has been updated aswell. Quick link: http://www.mplayerhq.hu/MPlayer/releases/MPlayer-1.0pre4.tar.bz2 Changelog: http://www.mplayerhq.hu/MPlayer/releases/ChangeLog-1.0pre4 -- Alex Beregszaszi e-mail: alex(a)fsn.hu Free Software Network cell: +36 70 3144424

1 0

[MPlayer-users] [ANNOUNCE] MPlayer 1.0pre3try2 RPMs available
by Dominik 'Rathann' Mierzejewski 01 Apr '04

01 Apr '04

Hello, everyone. RPM packages for 1.0pre3try2 are now available. The packages fix a serious vulnerability found in http parser recently. If you're using 1.0pre3, you should upgrade. See http://www.mplayerhq.hu/homepage/design6/news.html for more information. Leech from the following mirrors: PL1: http://ftp.icm.edu.pl/pub/linux/mplayer-rpms/apt/7.3/RPMS.testing/ PL2: http://greysector.rangers.eu.org/apt/7.3/RPMS.testing/ US1: ftp://ftp.falsehope.com/home/rathann/apt/7.3/RPMS.testing/ -- MPlayer RPMs maintainer: http://greysector.rangers.eu.org/mplayer.html "The Universe doesn't give you any points for doing things that are easy." -- Sheridan to Garibaldi in Babylon 5:"The Geometry of Shadows"

1 0