Heap-based buffer overflow in the DVD subpicture decoder in xine xine-lib 1-rc5 and earlier allows remote attackers to execute arbitrary code via a (1) DVD or (2) MPEG subpicture header where the second field reuses RLE data from the end of the first field.

A xine security announcement states :

A heap overflow has been found in the DVD subpicture decoder of xine-lib. This can be used for a remote heap overflow exploit, which can, on some systems, lead to or help in executing malicious code with the permissions of the user running a xine-lib based media application.

A heap overflow has been discovered in the DVD subpicture decoder of xine-lib. An attacker could cause arbitrary code to be executed on the victims host by supplying a malicious MPEG. By tricking users to view a malicious network stream, this is remotely exploitable.

A number of string overflows were discovered in the xine-lib program, some of which can be used for remote buffer overflow exploits that lead to the execution of arbitrary code with the permissions of the user running a xine-lib-based media application. xine-lib versions 1-rc2 through, and including, 1-rc5 are vulnerable to these problems.

As well, a heap overflow was found in the DVD subpicture decoder of xine-lib; this vulnerability is also remotely exploitable. All versions of xine-lib prior to and including 0.5.2 through, and including, 1-rc5 are vulnerable to this problem.

Patches from the xine-lib team have been backported and applied to the program to solve these problems.

The remote host is affected by the vulnerability described in GLSA-200409-30 (xine-lib: Multiple vulnerabilities)

    xine-lib contains two stack-based overflows and one heap-based     overflow. In the code reading VCD disc labels, the ISO disc label is     copied into an unprotected stack buffer of fixed size. Also, there is a     buffer overflow in the code that parses subtitles and prepares them for     display (XSA-2004-4). Finally, xine-lib contains a heap-based overflow     in the DVD sub-picture decoder (XSA-2004-5).
    (Please note that the VCD MRL issue mentioned in XSA-2004-4 was fixed     with GLSA 200408-18.)   Impact :

    With carefully-crafted VCDs, DVDs, MPEGs or subtitles, an attacker may     cause xine-lib to execute arbitrary code with the permissions of the     user.
  Workaround :

    There is no known workaround at this time.

The remote host is using a software linked again xine-lib, an open-source multimedia library. It is reported that versions up to 1.0 rc6a are vulnerable to multiple overflows in the DVD, subtitles and Video-CD modules. An attacker may craft a malicious multimedia file that may execute arbitrary code on the remote host if played with a xine-lib based software.

ID	Name	Product	Family	Severity
18847	FreeBSD : libxine -- DVD subpicture decoder heap overflow (131bd7c4-64a3-11d9-829a-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	high
16248	Debian DSA-657-1 : xine-lib - buffer overflow	Nessus	Debian Local Security Checks	high
15434	Mandrake Linux Security Advisory : xine-lib (MDKSA-2004:105)	Nessus	Mandriva Local Security Checks	high
14798	GLSA-200409-30 : xine-lib: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
2304	Xine-lib < 1.0 RC6a Heap and Stack Overflows	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2004-1379

critical

Tenable Plugins

high

high

high

high

medium