The DirectShow loader (loader/dshow/DS_VideoDecoder.c) in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1246.

Several local vulnerabilities have been discovered in Xine, a media player library, allowed for a denial of service or arbitrary code execution, which could be exploited through viewing malicious content.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1246 / CVE-2007-1387     The DMO_VideoDecoder_Open function does not set the     biSize before use in a memcpy, which allows     user-assisted remote attackers to cause a buffer     overflow and possibly execute arbitrary code (applies to     sarge only).

  - CVE-2008-0073     Array index error in the sdpplin_parse function allows     remote RTSP servers to execute arbitrary code via a     large streamid SDP parameter.

  - CVE-2008-0486     Array index vulnerability in libmpdemux/demux_audio.c     might allow remote attackers to execute arbitrary code     via a crafted FLAC tag, which triggers a buffer overflow     (applies to etch only).

  - CVE-2008-1161     Buffer overflow in the Matroska demuxer allows remote     attackers to cause a denial of service (crash) and     possibly execute arbitrary code via a Matroska file with     invalid frame sizes.

Moritz Jodeit discovered that the DirectShow loader of Xine did not correctly validate the size of an allocated buffer. By tricking a user into opening a specially crafted media file, an attacker could execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200705-21 (MPlayer: Two buffer overflows)

    A buffer overflow has been reported in the DMO_VideoDecoder_Open()     function in file loader/dmo/DMO_VideoDecoder.c. Another buffer overflow     has been reported in the DS_VideoDecoder_Open() function in file     loader/dshow/DS_VideoDecoder.c.
  Impact :

    A remote attacker could entice a user to open a specially crafted video     file, potentially resulting in the execution of arbitrary code with the     privileges of the user running MPlayer.
  Workaround :

    There is no known workaround at this time.

The DS_VideoDecoder_Open function in DirectShow/DS_VideoDecoder.c in xine-lib does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code.

Updated packages have been patched to address this issue.

The DS_VideoDecoder_Open function in loader/dshow/DS_VideoDecoder.c in MPlayer 1.0rc1 and earlier does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code.

Updated packages have been patched to address this issue.

The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code.

Updated packages have been patched to address this issue.

ID	Name	Product	Family	Severity
31721	Debian DSA-1536-1 : libxine - several vulnerabilities	Nessus	Debian Local Security Checks	high
28030	Ubuntu 5.10 / 6.06 LTS / 6.10 : xine-lib vulnerability (USN-435-1)	Nessus	Ubuntu Local Security Checks	medium
25360	GLSA-200705-21 : MPlayer: Two buffer overflows	Nessus	Gentoo Local Security Checks	high
24832	Mandrake Linux Security Advisory : xine-lib (MDKSA-2007:062)	Nessus	Mandriva Local Security Checks	medium
24831	Mandrake Linux Security Advisory : mplayer (MDKSA-2007:061)	Nessus	Mandriva Local Security Checks	medium
24805	Mandrake Linux Security Advisory : mplayer (MDKSA-2007:055)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2007-1387

critical

Tenable Plugins

high

medium

high

medium

medium

high