GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - GStreamer: heap-based buffer overflow in the RTSP connection parser via crafted server response leading to     remote code execution (CVE-2019-9928)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This update for gstreamer-plugins-base fixes the following issue :

Security issue fixed :

CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gstreamer-plugins-base fixes the following issue :

Security issue fixed :

  - CVE-2019-9928: Fixed a heap-based overflow in the rtsp     connection parser (bsc#1133375).

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-202003-33 (GStreamer Base Plugins: Heap-based buffer overflow)

    It was discovered that GStreamer Base Plugins did not correctly handle       certain malformed RTSP streams.
  Impact :

    A remote attacker could entice a user to open a specially crafted RTSP       stream with a GStreamer application, possibly resulting in the execution       of arbitrary code or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the version of the gstreamer1-plugins-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - GStreamer before 1.16.0 has a heap-based buffer     overflow in the RTSP connection parser via a crafted     response from a server, potentially allowing remote     code execution.(CVE-2019-9928)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gstreamer1-plugins-base package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - GStreamer before 1.16.0 has a heap-based buffer     overflow in the RTSP connection parser via a crafted     response from a server, potentially allowing remote     code execution.(CVE-2019-9928)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gstreamer-plugins-base fixes the following issue:
Security issue fixed :

  - CVE-2019-9928: Fixed a heap-based overflow in the rtsp     connection parser (bsc#1133375).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for gstreamer-0_10-plugins-base fixes the following issues :

Security issue fixed :

  - CVE-2019-9928: Fixed a heap-based overflow in the rtsp     connection parser (bsc#1133375).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for gstreamer-0_10-plugins-base fixes the following issues :

Security issue fixed :

CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gstreamer-plugins-base fixes the following issue:
Security issue fixed :

CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gstreamer-0_10-plugins-base fixes the following issue:
Security issue fixed :

CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gstreamer-0_10-plugins-base fixes the following issues :

Security issues fixed :

CVE-2017-5837: Fixed a floating point exception in gst_riff_create_audio_caps (bsc#1024076).

CVE-2017-5844: Fixed a floating point exception in gst_riff_create_audio_caps (bsc#1024079).

CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gstreamer-plugins-base package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - GStreamer before 1.16.0 has a heap-based buffer     overflow in the RTSP connection parser via a crafted     response from a server, potentially allowing remote     code execution.(CVE-2019-9928)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3958-1 advisory.

    It was discovered that GStreamer Base Plugins did not correctly handle certain malformed RTSP streams. If     a user were tricked into opening a crafted RTSP stream with a GStreamer application, an attacker could     cause a denial of service via application crash, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that a buffer overflow in the RTSP parser of the GStreamer media framework may result in the execution of arbitrary code if a malformed RTSP stream is opened.

The RTSP connection parser in the base GStreamer packages version 1.0, which is a streaming media framework, was vulnerable against an heap-based buffer overflow by sending a longer than allowed session id in a response and including a semicolon to change the maximum length.
This could result in a remote code execution.

For Debian 8 'Jessie', this problem has been fixed in version 1.4.4-2+deb8u2.

We recommend that you upgrade your gst-plugins-base1.0 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The RTSP connection parser in the base GStreamer packages version 0.10, which is a streaming media framework, was vulnerable against an heap-based buffer overflow by sending a longer than allowed session id in a response and including a semicolon to change the maximum length.
This could result in a remote code execution.

For Debian 8 'Jessie', this problem has been fixed in version 0.10.36-2+deb8u1.

We recommend that you upgrade your gst-plugins-base0.10 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198939	RHEL 7 : gstreamer-plugins-base (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
138261	SUSE SLED15 / SLES15 Security Update : gstreamer-plugins-base (SUSE-SU-2020:1300-2)	Nessus	SuSE Local Security Checks	high
136876	openSUSE Security Update : gstreamer-plugins-base (openSUSE-2020-678)	Nessus	SuSE Local Security Checks	high
136793	SUSE SLED15 / SLES15 Security Update : gstreamer-plugins-base (SUSE-SU-2020:1300-1)	Nessus	SuSE Local Security Checks	high
134610	GLSA-202003-33 : GStreamer Base Plugins: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	high
126865	EulerOS 2.0 SP2 : gstreamer1-plugins-base (EulerOS-SA-2019-1738)	Nessus	Huawei Local Security Checks	high
126554	EulerOS Virtualization for ARM 64 3.0.2.0 : gstreamer1-plugins-base (EulerOS-SA-2019-1712)	Nessus	Huawei Local Security Checks	high
126420	EulerOS 2.0 SP5 : gstreamer1-plugins-base (EulerOS-SA-2019-1678)	Nessus	Huawei Local Security Checks	high
126329	openSUSE Security Update : gstreamer-plugins-base (openSUSE-2019-1639)	Nessus	SuSE Local Security Checks	high
126328	openSUSE Security Update : gstreamer-0_10-plugins-base (openSUSE-2019-1638)	Nessus	SuSE Local Security Checks	high
126157	SUSE SLED12 / SLES12 Security Update : gstreamer-0_10-plugins-base (SUSE-SU-2019:1602-1)	Nessus	SuSE Local Security Checks	high
126155	SUSE SLED12 / SLES12 Security Update : gstreamer-plugins-base (SUSE-SU-2019:1600-1)	Nessus	SuSE Local Security Checks	high
125946	SUSE SLES12 Security Update : gstreamer-plugins-base (SUSE-SU-2019:1509-1)	Nessus	SuSE Local Security Checks	high
125945	SUSE SLES12 Security Update : gstreamer-0_10-plugins-base (SUSE-SU-2019:1508-1)	Nessus	SuSE Local Security Checks	high
125845	SUSE SLES11 Security Update : gstreamer-0_10-plugins-base (SUSE-SU-2019:14076-1)	Nessus	SuSE Local Security Checks	high
125506	EulerOS 2.0 SP5 : gstreamer-plugins-base (EulerOS-SA-2019-1579)	Nessus	Huawei Local Security Checks	high
125505	EulerOS 2.0 SP3 : gstreamer-plugins-base (EulerOS-SA-2019-1578)	Nessus	Huawei Local Security Checks	high
125504	EulerOS 2.0 SP2 : gstreamer-plugins-base (EulerOS-SA-2019-1577)	Nessus	Huawei Local Security Checks	high
124408	Ubuntu 16.04 LTS / 18.04 LTS : GStreamer Base Plugins vulnerability (USN-3958-1)	Nessus	Ubuntu Local Security Checks	high
124368	Debian DSA-4437-1 : gst-plugins-base1.0 - security update	Nessus	Debian Local Security Checks	high
124343	Debian DLA-1770-1 : gst-plugins-base1.0 security update	Nessus	Debian Local Security Checks	high
124342	Debian DLA-1769-1 : gst-plugins-base0.10 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-9928

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high