Buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp in Exiv2 0.24 allows remote attackers to cause a denial of service (crash) via a long IKEY INFO tag value in an AVI file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp in Exiv2 0.24 allows remote     attackers to cause a denial of service (crash) via a long IKEY INFO tag value in an AVI file.
    (CVE-2014-9449)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201507-03 (Exiv2: Denial of Service)

    Exiv2 has a buffer overflow in the RiffVideo::infoTagsHandler function       in riffvideo.cpp.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition via       a specially crafted AVI file with IKEY INFO tag.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2014-9449

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Exiv2 incorrectly handled certain tag values in video files. If a user or automated system were tricked into opening a specially crafted video file, a remote attacker could cause Exiv2 to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
218696	Linux Distros Unpatched Vulnerability : CVE-2014-9449	Nessus	Misc.	medium
84602	GLSA-201507-03 : Exiv2: Denial of Service	Nessus	Gentoo Local Security Checks	medium
80892	Fedora 21 : exiv2-0.24-4.fc21 (2015-0301)	Nessus	Fedora Local Security Checks	medium
80412	Ubuntu 14.10 : exiv2 vulnerability (USN-2454-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2014-9449

medium

Tenable Plugins

medium

medium

medium

medium