Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 481267 - (CVE-2009-0397) CVE-2009-0397 gstreamer-plugins, gstreamer-plugins-good: heap-based buffer overflow while parsing malformed QuickTime media files via crafted Time-to-sample (stss) atom data
CVE-2009-0397 gstreamer-plugins, gstreamer-plugins-good: heap-based buffer ov...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
http://trapkit.de/advisories/TKADV200...
public=20090122,reported=20090123,imp...
: Security
Depends On: 483217 483218 483220 483221 833907
Blocks:
  Show dependency tree / graph
 
Reported: 2009-01-23 05:19 EST by Jan Lieskovsky
Modified: 2016-03-04 06:54 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-02-26 04:16:18 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:0270 normal SHIPPED_LIVE Important: gstreamer-plugins security update 2009-02-06 07:50:44 EST
Red Hat Product Errata RHSA-2009:0271 normal SHIPPED_LIVE Important: gstreamer-plugins-good security update 2009-02-06 07:42:09 EST

  None (edit)
Description Jan Lieskovsky 2009-01-23 05:19:33 EST 
Multiple heap-based buffer overflow vulnerabilities and one an array index
out of bounds vulnerability has been reported by Tobias Klein to 
be present in the GStreamer demuxer responsible for demuxing QuickTime
media *.mov files into raw or compressed audio and/or video streams. A remote attacker could use this flaws to execute arbitrary code in the context of an application using the GStreamer multimedia framework.

References:
http://trapkit.de/advisories/TKADV2009-003.txt
http://getsongbird.com/
http://projects.gnome.org/totem/
http://amarok.kde.org/ 
http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53

Proposed solution:
Upgrade to GStreamer gst-plugins-good version >= 0.10.12.

Credit: Tobias Klein
Comment 1 Jan Lieskovsky 2009-01-23 07:04:04 EST 
This issue affects the version of the gstreamer-plugins-good package,
as shipped with Red Hat Enterprise Linux 5.

This issue affects all versions of the gstreamer-plugins-good package,
as shipped with Fedora releases of 9, 10 and devel.

============================================================================

This issue does NOT affect the versions of the gstreamer package, as shipped
with Red Hat Enterprise Linux 3, 4, 5 and Fedora releases of 9, 10 and devel.

This issue does NOT affect the versions of the totem package, as shipped
with Red Hat Enterprise Linux 5 and Fedora releases of 9, 10 and devel.

This issue does NOT affect the versions of the rhythmbox package, as shipped
with Red Hat Enterprise Linux 4, and 5 and Fedora releases of 9, 10 and devel.

This issue does NOT affect the versions of the amarok package, as shipped
with Fedora releases of 9, 10 and devel.
Comment 4 Bastien Nocera 2009-02-02 10:11:53 EST 
(In reply to comment #1)
> This issue affects the version of the gstreamer-plugins-good package,
> as shipped with Red Hat Enterprise Linux 5.
> 
> This issue affects all versions of the gstreamer-plugins-good package,
> as shipped with Fedora releases of 9, 10 and devel.

No it doesn't. It only affects Fedora 9 and Fedora 10. Rawhide already has a new enough version that include those fixes.

Devel:
http://koji.fedoraproject.org/koji/buildinfo?buildID=80255
Fedora 10:
https://admin.fedoraproject.org/updates/gstreamer-plugins-good-0.10.13-1.fc10
Fedora 9:
https://admin.fedoraproject.org/updates/gstreamer-plugins-good-0.10.8-10.fc9
Comment 6 Jan Lieskovsky 2009-02-03 07:49:42 EST 
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0397 to
the following vulnerability:

Heap-based buffer overflow in the qtdemux_parse_samples function in
gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka
gst-plugins-good) 0.10.9 through 0.10.11, and GStreamer Plug-ins (aka
gstreamer-plugins) 0.8.5, might allow remote attackers to execute
arbitrary code via crafted Time-to-sample (aka stts) atom data in a
malformed QuickTime media .mov file.


References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0397
http://www.securityfocus.com/archive/1/archive/1/500317/100/0/threaded
http://www.openwall.com/lists/oss-security/2009/01/29/3
http://trapkit.de/advisories/TKADV2009-003.txt
http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53
http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html
http://www.securityfocus.com/bid/33405
http://www.frsirt.com/english/advisories/2009/0225
http://secunia.com/advisories/33650
Comment 8 Fedora Update System 2009-02-24 15:41:42 EST 
gstreamer-plugins-good-0.10.8-10.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2009-02-24 15:56:56 EST 
gstreamer-plugins-good-0.10.13-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.