Multiple integer overflows in MPlayer 1.0pre7try2 allow remote attackers to cause a denial of service and trigger heap-based buffer overflows via (1) a certain ASF file handled by asfheader.c that causes the asf_descrambling function to be passed a negative integer after the conversion from a char to an int or (2) an AVI file with a crafted wLongsPerEntry or nEntriesInUse value in the indx chunk, which is handled in aviheader.c.

A heap-based buffer overflow was found in MPlayer's AVI handling that could allow a remote attacker to cause a denial of service or possibly execute arbitrary code via a crafted .avi file.

Updated packages have been patched to prevent this issue.

Secunia reports :

The vulnerabilities are caused due to integer overflow errors in 'libmpdemux/asfheader.c' within the handling of an ASF file, and in 'libmpdemux/aviheader.c' when parsing the 'indx' chunk in an AVI file.
This can be exploited to cause heap-based buffer overflows via a malicious ASF file, or via a AVI file with specially crafted 'wLongsPerEntry' and 'nEntriesInUse' values in the 'indx' chunk.

The remote host is affected by the vulnerability described in GLSA-200605-01 (MPlayer: Heap-based buffer overflow)

    Xfocus Team discovered multiple integer overflows that may lead to a     heap-based buffer overflow.
  Impact :

    An attacker could entice a user to play a specially crafted multimedia     file, potentially resulting in the execution of arbitrary code with the     privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

Multiple integer overflows in MPlayer 1.0pre7try2 allow remote attackers to cause a denial of service and trigger heap-based buffer overflows via (1) a certain ASF file handled by asfheader.c that causes the asf_descrambling function to be passed a negative integer after the conversion from a char to an int or (2) an AVI file with a crafted wLongsPerEntry or nEntriesInUse value in the indx chunk, which is handled in aviheader.c.

The updated packages have been patched to prevent this problem.

The remote host is using a version of MPlayer, a multimedia video and audio application.  This version of MPlayer is vulnerable to an integer overflow due to a lack of content parsing.  An attacker exploiting this flaw would need to craft a malicious media file and then convince a local user to download and play the file within MPlayer.  Successful exploitation would result in arbitrary code being executed locally.

ID	Name	Product	Family	Type	Severity
26902	Mandrake Linux Security Advisory : mplayer (MDKSA-2007:192)	Nessus	Mandriva Local Security Checks	Local	high
21511	FreeBSD : mplayer -- Multiple integer overflows (c7526a14-c4dc-11da-9699-00123ffe8333)	Nessus	FreeBSD Local Security Checks	Local	medium
21316	GLSA-200605-01 : MPlayer: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	Local	medium
21203	Mandrake Linux Security Advisory : mplayer (MDKSA-2006:068)	Nessus	Mandriva Local Security Checks	Local	medium
3491	MPlayer Crafted Media File Integer Overflow	Nessus Network Monitor	Web Clients		medium

Detections

Analytics

CVE-2006-1502

medium

Tenable Plugins

high

medium

medium

medium

medium