Security bugs are reported here via bugzilla

[Thomas Houssin <thomas.houssin AT gmail.com>]

Synopsis
========
A format string vulnerability in input_cdda.c in xine-lib allows remote
servers to execute arbitrary code via format string specifiers in
metadata in CDDB server responses when the victim plays a CD.

Background
==========
xine is a free multimedia player. It plays back CDs, DVDs, and VCDs. It
also decodes multimedia files like AVI, MOV, WMV, and MP3 from local
disk drives, and displays multimedia streamed over the Internet.

Description
===========
CAN-2005-2967:
By setting up a malicious CDDB server, an attacker can overwrite
arbitrary memory locations with arbitrary data. This can be used to
execute attacker-chosen malicious code with the permissions of the user
running a xine-lib based media application. This problem was reported by
Ulf Harnhammar from the Debian Security Audit Project.

Impact
======
When playing an Audio CD, a xine-lib based media application contacts a
CDDB server to retrieve metadata like the title and artist's name.
During processing of this data, a response from the server, which is
located in memory on the stack, is passed to the fprintf() function as a
format string. An attacker can set up a malicious CDDB server and trick
the client into using this server instead of the pre-configured one.
Alternatively, any user and therefore the attacker can modify entries in
the official CDDB server. Using this format string vulnerability,
attacker-chosen data can be written to an attacker-chosen memory
location. This allows the attacker to alter the control flow and to
execute malicious code with the permissions of the user running the
application. Although it requires the user to play an Audio CD, this
vulnerability can still be exploited remotely, because a xine Audio CD
MRL (media resource locator) could be embedded into a website.

Workaround
==========
There are no known workarounds at this time.

Affected packages
=================
This is now fixed in all grimoires.

Resolution
==========
All xine-lib users should upgrade to the latest available version:
         # scribe update
         # cast -c xine-lib

References
==========
   [ 1 ] CAN-2005-2967
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2967
   [ 2 ] XSA-2005-1
         http://xinehq.de/index.php/security/XSA-2005-1


-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature