Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to cause a denial of service (process termination) and possibly execute arbitrary code via a crafted video file that causes the stream_read function to read or write arbitrary memory.

A vulnerability that was discovered in xine-lib that allowed remote RTSP servers to execute arbitrary code via a large streamid SDP parameter also affects MPlayer (CVE-2008-0073).

Several integer overflows were discovered by Felipe Andres Manzano in MPlayer's Real video stream demuxing code. These vulnerabilities could allow an attacker to cause a crash or possibly execute arbitrary code by supplying a malicious crafted video file (CVE-2008-3827).

The updated packages have been patched to fix these issues. Note that CVE-2008-3827 was already corrected in the Mandriva Linux 2009 packages.

The remote host is affected by the vulnerability described in GLSA-200901-07 (MPlayer: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in MPlayer:
    A     stack-based buffer overflow was found in the str_read_packet() function     in libavformat/psxstr.c when processing crafted STR files that     interleave audio and video sectors (CVE-2008-3162).
    Felipe     Andres Manzano reported multiple integer underflows in the     demux_real_fill_buffer() function in demux_real.c when processing     crafted Real Media files that cause the stream_read() function to read     or write arbitrary memory (CVE-2008-3827).
    Tobias Klein     reported a stack-based buffer overflow in the demux_open_vqf() function     in libmpdemux/demux_vqf.c when processing malformed TwinVQ files     (CVE-2008-5616).
  Impact :

    A remote attacker could entice a user to open a specially crafted STR,     Real Media, or TwinVQ file to execute arbitrary code or cause a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

Felipe Andres Manzano discovered that mplayer, a multimedia player, is vulnerable to several integer overflows in the Real video stream demuxing code. These flaws could allow an attacker to cause a denial of service (a crash) or potentially execution of arbitrary code by supplying a maliciously crafted video file.

The oCERT team reports :

The MPlayer multimedia player suffers from a vulnerability which could result in arbitrary code execution and at the least, in unexpected process termination. Three integer underflows located in the Real demuxer code can be used to exploit a heap overflow, a specific video file can be crafted in order to make the stream_read function reading or writing arbitrary amounts of memory.

ID	Name	Product	Family	Severity
37535	Mandriva Linux Security Advisory : mplayer (MDVSA-2008:219)	Nessus	Mandriva Local Security Checks	high
35355	GLSA-200901-07 : MPlayer: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
34340	Debian DSA-1644-1 : mplayer - integer overflow	Nessus	Debian Local Security Checks	high
34327	FreeBSD : mplayer -- multiple integer overflows (724e6f93-8f2a-11dd-821f-001cc0377035)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2008-3827

high

Tenable Plugins

high

critical

high

high