Security bugs are reported here via bugzilla

[Seth Alan Woolley <seth AT positivism.org>]

We were updated already, except I integrated MPlayer into stable from
test.  Now all grimoires should be safe.

Seth

----- Forwarded message from Thierry Carrez <koon AT gentoo.org> -----

From: Thierry Carrez <koon AT gentoo.org>
To: gentoo-announce AT lists.gentoo.org
CC: bugtraq AT securityfocus.com, full-disclosure AT lists.netsys.com,
        security-alerts AT linuxsecurity.com
Subject: [Full-Disclosure] [ GLSA 200405-24 ] MPlayer,
        xine-lib: vulnerabilities in RTSP stream handling
Precedence: bulk
Date: Fri, 28 May 2004 19:24:55 +0200
X-Spambayes-Classification: ham; 0.00

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200405-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: MPlayer, xine-lib: vulnerabilities in RTSP stream handling
      Date: May 28, 2004
      Bugs: #49387
        ID: 200405-24

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities, including remotely exploitable buffer
overflows, have been found in code common to MPlayer and the xine
library.

Background
==========

MPlayer is a movie player capable of handling multiple multimedia file
formats. xine-lib is a multimedia player library used by several
graphical user interfaces, including xine-ui. They both use the same
code to handle Real-Time Streaming Protocol (RTSP) streams from
RealNetworks servers.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /   Vulnerable   /                Unaffected
    -------------------------------------------------------------------
  1  media-video/mplayer      < 1.0_pre4                   >= 1.0_pre4
                                                            <= 0.92-r1
  2  media-libs/xine-lib        < 1_rc4                       >= 1_rc4
                                                          <= 0.9.13-r3

Description
===========

Multiple vulnerabilities have been found and fixed in the RTSP handling
code common to recent versions of these two packages. These
vulnerabilities include several remotely exploitable buffer overflows.

Impact
======

A remote attacker, posing as a RTSP stream server, can execute
arbitrary code with the rights of the user of the software playing the
stream (MPlayer or any player using xine-lib). Another attacker may
entice a user to use a maliciously crafted URL or playlist to achieve
the same results.

Workaround
==========

For MPlayer, there is no known workaround at this time. For xine-lib,
you can delete the xineplug_inp_rtsp.so file.

Resolution
==========

All users should upgrade to non-vulnerable versions of MPlayer and
xine-lib:

    # emerge sync

    # emerge -pv ">=media-video/mplayer-1.0_pre4"
    # emerge ">=media-video/mplayer-1.0_pre4"

    # emerge -pv ">=media-libs/xine-lib-1_rc4"
    # emerge ">=media-libs/xine-lib-1_rc4"

References
==========

  [ 1 ] Xine security advisory
        http://xinehq.de/index.php/security/XSA-2004-3
  [ 2 ] CAN-2004-0433
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0433

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

     http://security.gentoo.org/glsa/glsa-200405-24.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security AT gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Technologies, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


----- End forwarded message -----

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8  3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgpQ9qO3bp_mC.pgp
Description: PGP signature