Multiple heap-based buffer overflows in the code used to handle (1) MMS over TCP (MMST) streams or (2) RealMedia RTSP streams in xine-lib before 1.0, and other products that use xine-lib such as MPlayer 1.0pre6 and earlier, allow remote malicious servers to execute arbitrary code.

Two buffer overflows have been discovered in the MMS and Real RTSP stream handlers of the Xine library. By tricking a user to connect to a malicious MMS or RTSP video/audio stream source with an application that uses this library, an attacker could crash the client and possibly even execute arbitrary code with the privileges of the player application.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A xine security announcement reports :

By a user receiving data from a malicious network streaming server, an attacker can overrun a heap buffer, which can, on some systems, lead to or help in executing attacker-chosen malicious code with the permissions of the user running a xine-lib based media application.

Both the MMS and Real RTSP streaming client code made some too-strong assumptions on the transferred data. Several critical bounds checks were missing, resulting in the possibility of heap overflows, should the remote server not adhere to these assumptions. In the MMS case, a remote server could present content with too many individual streams;
in the RTSP case, a remote server's reply could have too many lines.

An attacker can set up a server delivering malicious data to the users. This can be used to overflow a heap buffer, which can, with certain implementations of heap management, lead to attacker chosen data written to the stack. This can cause attacker-chosen code being executed with the permissions of the user running the application. By tricking users to retrieve a stream, which can be as easy as providing a link on a website, this vulnerability can be exploited remotely.

Two heap overflows were discovered in mplayer's code handling the RealMedia RTSP and Microsoft Media Services streams over TCP (MMST).
These vulnerabilities could allow for a malicious server to execute arbitrary code on the client computer with the permissions of the user running MPlayer.

The updated packages have been patched to correct this problem.

Two buffer overflow vulnerabilities were discovered in the MMS and Real RTSP stream handlers in the Xine libraries. If an attacker can trick a user to connect to a malicious MMS or RTSP video/audio stream source with any application using this library, they could crash the client and possibly even execute arbitrary code with the privileges of the user running the player program.

The updated packages have been patched to correct these problems.

The remote host is affected by the vulnerability described in GLSA-200504-19 (MPlayer: Two heap overflow vulnerabilities)

    Heap overflows have been found in the code handling RealMedia RTSP and     Microsoft Media Services streams over TCP (MMST).
  Impact :

    By setting up a malicious server and enticing a user to use its     streaming data, a remote attacker could possibly execute arbitrary code     on the client computer with the permissions of the user running     MPlayer.
  Workaround :

    There is no known workaround at this time.

The remote host is using a version of Mplayer, a multimedia video and audio application, that is vulnerable to several heap-based overflows that may allow an attacker to execute arbitrary code on the remote system.

ID	Name	Product	Family	Severity
20512	Ubuntu 4.10 / 5.04 : xine-lib vulnerabilities (USN-123-1)	Nessus	Ubuntu Local Security Checks	high
19031	FreeBSD : mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities (91c606fc-b5d0-11d9-a788-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
18677	Mandrake Linux Security Advisory : mplayer (MDKSA-2005:115)	Nessus	Mandriva Local Security Checks	high
18412	Mandrake Linux Security Advisory : xine-lib (MDKSA-2005:094)	Nessus	Mandriva Local Security Checks	high
18102	GLSA-200504-19 : MPlayer: Two heap overflow vulnerabilities	Nessus	Gentoo Local Security Checks	high
2844	MPlayer < 1.0pre7 Multiple Remote Heap-based Overflows	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2005-1195

critical

Tenable Plugins

high

high

high

high

high

medium