Multiple integer overflows in MPlayer 1.0pre7try2 allow remote attackers to cause a denial of service and trigger heap-based buffer overflows via (1) a certain ASF file handled by asfheader.c that causes the asf_descrambling function to be passed a negative integer after the conversion from a char to an int or (2) an AVI file with a crafted wLongsPerEntry or nEntriesInUse value in the indx chunk, which is handled in aviheader.c.

A heap-based buffer overflow was found in MPlayer's AVI handling that could allow a remote attacker to cause a denial of service or possibly execute arbitrary code via a crafted .avi file.

Updated packages have been patched to prevent this issue.

Secunia reports :

The vulnerabilities are caused due to integer overflow errors in 'libmpdemux/asfheader.c' within the handling of an ASF file, and in 'libmpdemux/aviheader.c' when parsing the 'indx' chunk in an AVI file.
This can be exploited to cause heap-based buffer overflows via a malicious ASF file, or via a AVI file with specially crafted 'wLongsPerEntry' and 'nEntriesInUse' values in the 'indx' chunk.

The remote host is affected by the vulnerability described in GLSA-200605-01 (MPlayer: Heap-based buffer overflow)

    Xfocus Team discovered multiple integer overflows that may lead to a     heap-based buffer overflow.
  Impact :

    An attacker could entice a user to play a specially crafted multimedia     file, potentially resulting in the execution of arbitrary code with the     privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

Multiple integer overflows in MPlayer 1.0pre7try2 allow remote attackers to cause a denial of service and trigger heap-based buffer overflows via (1) a certain ASF file handled by asfheader.c that causes the asf_descrambling function to be passed a negative integer after the conversion from a char to an int or (2) an AVI file with a crafted wLongsPerEntry or nEntriesInUse value in the indx chunk, which is handled in aviheader.c.

The updated packages have been patched to prevent this problem.

The remote host is using a version of MPlayer, a multimedia video and audio application.  This version of MPlayer is vulnerable to an integer overflow due to a lack of content parsing.  An attacker exploiting this flaw would need to craft a malicious media file and then convince a local user to download and play the file within MPlayer.  Successful exploitation would result in arbitrary code being executed locally.

ID	Name	Product	Family	Severity
26902	Mandrake Linux Security Advisory : mplayer (MDKSA-2007:192)	Nessus	Mandriva Local Security Checks	high
21511	FreeBSD : mplayer -- Multiple integer overflows (c7526a14-c4dc-11da-9699-00123ffe8333)	Nessus	FreeBSD Local Security Checks	medium
21316	GLSA-200605-01 : MPlayer: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	medium
21203	Mandrake Linux Security Advisory : mplayer (MDKSA-2006:068)	Nessus	Mandriva Local Security Checks	medium
3491	MPlayer Crafted Media File Integer Overflow	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2006-1502

medium

Tenable Plugins

high

medium

medium

medium

medium