Multiple stack-based buffer overflows in xine-lib 1-rc2 through 1-rc5 allow attackers to execute arbitrary code via (1) long VideoCD vcd:// MRLs or (2) long subtitle lines.

A number of string overflows were discovered in the xine-lib program, some of which can be used for remote buffer overflow exploits that lead to the execution of arbitrary code with the permissions of the user running a xine-lib-based media application. xine-lib versions 1-rc2 through, and including, 1-rc5 are vulnerable to these problems.

As well, a heap overflow was found in the DVD subpicture decoder of xine-lib; this vulnerability is also remotely exploitable. All versions of xine-lib prior to and including 0.5.2 through, and including, 1-rc5 are vulnerable to this problem.

Patches from the xine-lib team have been backported and applied to the program to solve these problems.

The remote host is affected by the vulnerability described in GLSA-200409-30 (xine-lib: Multiple vulnerabilities)

    xine-lib contains two stack-based overflows and one heap-based     overflow. In the code reading VCD disc labels, the ISO disc label is     copied into an unprotected stack buffer of fixed size. Also, there is a     buffer overflow in the code that parses subtitles and prepares them for     display (XSA-2004-4). Finally, xine-lib contains a heap-based overflow     in the DVD sub-picture decoder (XSA-2004-5).
    (Please note that the VCD MRL issue mentioned in XSA-2004-4 was fixed     with GLSA 200408-18.)   Impact :

    With carefully-crafted VCDs, DVDs, MPEGs or subtitles, an attacker may     cause xine-lib to execute arbitrary code with the permissions of the     user.
  Workaround :

    There is no known workaround at this time.

The remote host is using a software linked again xine-lib, an open-source multimedia library. It is reported that versions up to 1.0 rc6a are vulnerable to multiple overflows in the DVD, subtitles and Video-CD modules. An attacker may craft a malicious multimedia file that may execute arbitrary code on the remote host if played with a xine-lib based software.

The remote host is affected by the vulnerability described in GLSA-200408-18 (xine-lib: VCD MRL buffer overflow)

    xine-lib contains a bug where it is possible to overflow the vcd://     input source identifier management buffer through carefully crafted     playlists.
  Impact :

    An attacker may construct a carefully-crafted playlist file which will     cause xine-lib to execute arbitrary code with the permissions of the     user. In order to conform with the generic naming standards of most     Unix-like systems, playlists can have extensions other than .asx (the     standard xine playlist format), and made to look like another file     (MP3, AVI, or MPEG for example). If an attacker crafts a playlist with     a valid header, they can insert a VCD playlist line that can cause a     buffer overflow and possible shellcode execution.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version of xine-lib.

ID	Name	Product	Family	Severity
15434	Mandrake Linux Security Advisory : xine-lib (MDKSA-2004:105)	Nessus	Mandriva Local Security Checks	high
14798	GLSA-200409-30 : xine-lib: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
2304	Xine-lib < 1.0 RC6a Heap and Stack Overflows	Nessus Network Monitor	Web Clients	medium
14574	GLSA-200408-18 : xine-lib: VCD MRL buffer overflow	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2004-1475

critical

Tenable Plugins

high

high

medium

medium