Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via (1) a crafted .FLV file, which triggers an overflow in demuxers/demux_flv.c; (2) a crafted .MOV file, which triggers an overflow in demuxers/demux_qt.c; (3) a crafted .RM file, which triggers an overflow in demuxers/demux_real.c; (4) a crafted .MVE file, which triggers an overflow in demuxers/demux_wc3movie.c; (5) a crafted .MKV file, which triggers an overflow in demuxers/ebml.c; or (6) a crafted .CAK file, which triggers an overflow in demuxers/demux_film.c.

Alin Rad Pop found an array index vulnerability in the SDP parser of xine-lib. If a user or automated system were tricked into opening a malicious RTSP stream, a remote attacker could possibly execute arbitrary code with the privileges of the user using the program (CVE-2008-0073).

The ASF demuxer in xine-lib did not properly check the length of ASF headers. If a user was tricked into opening a crafted ASF file, a remote attacker could possibly cause a denial of service or execute arbitrary code with the privileges of the user using the program (CVE-2008-1110).

The Matroska demuxer in xine-lib did not properly verify frame sizes, which could possibly lead to the execution of arbitrary code if a user opened a crafted ASF file (CVE-2008-1161).

Luigi Auriemma found multiple integer overflows in xine-lib. If a user was tricked into opening a crafted FLV, MOV, RM, MVE, MKV, or CAK file, a remote attacker could possibly execute arbitrary code with the privileges of the user using the program (CVE-2008-1482).

Guido Landi found A stack-based buffer overflow in xine-lib that could allow a remote attacker to cause a denial of service (crash) and potentially execute arbitrary code via a long NSF title (CVE-2008-1878).

The updated packages have been patched to correct this issue.

Alin Rad Pop discovered an array index vulnerability in the SDP parser. If a user or automated system were tricked into opening a malicious RTSP stream, a remote attacker may be able to execute arbitrary code with the privileges of the user invoking the program.
(CVE-2008-0073)

Luigi Auriemma discovered that xine-lib did not properly check buffer sizes in the RTSP header-handling code. If xine-lib opened an RTSP stream with crafted SDP attributes, a remote attacker may be able to execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-0225, CVE-2008-0238)

Damian Frizza and Alfredo Ortega discovered that xine-lib did not properly validate FLAC tags. If a user or automated system were tricked into opening a crafted FLAC file, a remote attacker may be able to execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-0486)

It was discovered that the ASF demuxer in xine-lib did not properly check the length if the ASF header. If a user or automated system were tricked into opening a crafted ASF file, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-1110)

It was discovered that the Matroska demuxer in xine-lib did not properly verify frame sizes. If xine-lib opened a crafted ASF file, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2008-1161)

Luigi Auriemma discovered multiple integer overflows in xine-lib. If a user or automated system were tricked into opening a crafted FLV, MOV, RM, MVE, MKV or CAK file, a remote attacker may be able to execute arbitrary code with the privileges of the user invoking the program.
(CVE-2008-1482)

It was discovered that xine-lib did not properly validate its input when processing Speex file headers. If a user or automated system were tricked into opening a specially crafted Speex file, an attacker could create a denial of service or possibly execute arbitrary code as the user invoking the program. (CVE-2008-1686)

Guido Landi discovered a stack-based buffer overflow in xine-lib when processing NSF files. If xine-lib opened a specially crafted NSF file with a long NSF title, an attacker could create a denial of service or possibly execute arbitrary code as the user invoking the program.
(CVE-2008-1878).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200808-01 (xine-lib: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been discovered in xine-lib:
    Alin Rad Pop of Secunia reported an array indexing vulnerability in the     sdpplin_parse() function in the file input/libreal/sdpplin.c when     processing streams from RTSP servers that contain a large 'streamid'     SDP parameter (CVE-2008-0073).
    Luigi Auriemma reported multiple integer overflows that result in     heap-based buffer overflows when processing '.FLV', '.MOV' '.RM',     '.MVE', '.MKV', and '.CAK' files (CVE-2008-1482).
    Guido Landi reported a stack-based buffer overflow in the     demux_nsf_send_chunk() function when handling titles within NES Music     (.NSF) files (CVE-2008-1878).
  Impact :

    A remote attacker could entice a user to play a specially crafted video     file or stream with a player using xine-lib, potentially resulting in     the execution of arbitrary code with the privileges of the user running     the player.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been discovered in xine-lib, a library which supplies most of the application functionality of the xine multimedia player. The Common Vulnerabilities and Exposures project identifies the following three problems :

  - CVE-2008-1482     Integer overflow vulnerabilities exist in xine's FLV,     QuickTime, RealMedia, MVE and CAK demuxers, as well as     the EBML parser used by the Matroska demuxer. These     weaknesses allow an attacker to overflow heap buffers     and potentially execute arbitrary code by supplying a     maliciously crafted file of those types.

  - CVE-2008-1686     Insufficient input validation in the Speex     implementation used by this version of xine enables an     invalid array access and the execution of arbitrary code     by supplying a maliciously crafted Speex file.

  - CVE-2008-1878     Inadequate bounds checking in the NES Sound Format (NSF)     demuxer enables a stack-based buffer overflow and the     execution of arbitrary code through a maliciously     crafted NSF file.

This updates xine-lib to 1.1.11.1, which fixes the following security vulnerabilities: CVE-2008-0073 array indexing (fixed in 1.1.11), CVE-2008-1482 integer overflow (fixed in 1.1.11.1). It also provides a versioned xine-lib (plugin-abi) so 3rd party packages installing plugins can use it instead of requiring a version of xine-lib.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

1.1.11.1 (security update, #438663, CVE-2008-1482). Provide versioned xine- lib(plugin-abi) so 3rd party packages installing plugins can use it instead of requiring a version of xine-lib.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted files could cause integer overflows in the xine library. Attackers could potentially exploit that to execute arbitrary code with the privileges of the user who opened such a file.
(CVE-2008-1482)

Specially crafted files could cause integer overflows in the xine library. Attackers could potentially exploit that to execute arbitrary code with the privileges of the user who opened such a file (CVE-2008-1482).

New xine-lib packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues.

ID	Name	Product	Family	Severity
36948	Mandriva Linux Security Advisory : xine-lib (MDVSA-2008:178)	Nessus	Mandriva Local Security Checks	high
33940	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : xine-lib vulnerabilities (USN-635-1)	Nessus	Ubuntu Local Security Checks	high
33831	GLSA-200808-01 : xine-lib: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
32435	Debian DSA-1586-1 : xine-lib - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
31818	Fedora 7 : xine-lib-1.1.11.1-1.fc7 (2008-2945)	Nessus	Fedora Local Security Checks	medium
31815	Fedora 8 : xine-lib-1.1.11.1-1.fc8 (2008-2849)	Nessus	Fedora Local Security Checks	medium
31782	SuSE 10 Security Update : xine (ZYPP Patch Number 5139)	Nessus	SuSE Local Security Checks	medium
31781	openSUSE 10 Security Update : xine-devel (xine-devel-5137)	Nessus	SuSE Local Security Checks	medium
31739	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / current : xine-lib (SSA:2008-092-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2008-1482

high

Tenable Plugins

high

high

high

high

medium

medium

medium

medium

medium