Detections
Analytics

GLSA-200803-08 : Win32 binary codecs: Multiple vulnerabilities

high Nessus Plugin ID 31383

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200803-08 (Win32 binary codecs: Multiple vulnerabilities)

 Multiple buffer overflow, heap overflow, and integer overflow vulnerabilities were discovered in the Quicktime plugin when processing MOV, FLC, SGI, H.264 and FPX files.
 Impact :

 A remote attacker could entice a user to open a specially crafted video file, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application.
 Workaround :

 There is no known workaround at this time.

Solution

All Win32 binary codecs users should upgrade to the latest version:
 # emerge --sync # emerge --ask --oneshot --verbose '>=media-libs/win32codecs-20071007-r2' Note: Since no updated binary versions have been released, the Quicktime libraries have been removed from the package. Please use the free alternative Quicktime implementations within VLC, MPlayer or Xine for playback.

See Also

https://security.gentoo.org/glsa/200803-08

Plugin Details

Severity: High

ID: 31383

File Name: gentoo_GLSA-200803-08.nasl

Version: 1.20

Type: local

Published: 3/7/2008

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

CVSS v2

Risk Factor: High

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/o:gentoo:linux, p-cpe:/a:gentoo:linux:win32codecs

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/4/2008

Vulnerability Publication Date: 9/12/2006

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Apple QuickTime 7.3 RTSP Response Header Buffer Overflow)

Reference Information

CVE: CVE-2006-4382, CVE-2006-4384, CVE-2006-4385, CVE-2006-4386, CVE-2006-4388, CVE-2006-4389, CVE-2007-4674, CVE-2007-6166

CWE: 119, 189

GLSA: 200803-08