Stack-based buffer overflow in libmms, as used by (a) MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4) get_media_packet functions, and possibly other functions.

Matthias Hopf discovered several buffer overflows in libmms. By tricking a user into opening a specially crafted remote multimedia stream with an application using libmms, a remote attacker could exploit this to execute arbitrary code with the user's privileges.

The Xine library contains an embedded copy of libmms, and thus needs the same security update.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several buffer overflows were found in libmms. By tricking a user into opening a specially crafted remote multimedia stream with an application using libmms, a remote attacker could overwrite an arbitrary memory portion with zeros, thereby crashing the program.

In Ubuntu 5.10, this affects the GStreamer MMS plugin (gstreamer0.8-mms). Other Ubuntu releases do not support this library.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New xine-lib packages are available for Slackware 9.1, 10.0, 10.1, 10.2, and 11.0 to fix security issues.

The libxine development team reports that several vulnerabilities had been found in the libxine library. The first vulnerability is caused by improper checking of the src/input/libreal/real.c 'real_parse_sdp()' function. A remote attacker could exploit this by tricking an user to connect to a preparated server potentially causing a buffer overflow. Another buffer overflow had been found in the libmms library, potentially allowing a remote attacker to cause a denial of service vulnerability, and possible remote code execution through the following functions: send_command, string_utf16, get_data and get_media_packets. Other functions might be affected as well.

Mitre CVE reports :

Stack-based buffer overflow in libmms, as used by (a) MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4) get_media_packet functions, and possibly other functions.

The remote host is affected by the vulnerability described in GLSA-200607-07 (xine-lib: Buffer overflow)

    There is a stack based overflow in the libmms library included with     xine-lib which can be triggered by malicious use of the send_command,     string_utf16, get_data and get_media_packet functions.
  Impact :

    A remote attacker could design a malicious media file that would     trigger the overflow, potentially resulting in the execution of     arbitrary code.
  Workaround :

    There is no known workaround at this time.

Stack-based buffer overflow in MiMMS 0.0.9 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4) get_media_packet functions, and possibly other functions. Xine-lib contains an embedded copy of the same vulnerable code.

The updated packages have been patched to correct this issue.

Stack-based buffer overflow in MiMMS 0.0.9 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4) get_media_packet functions, and possibly other functions. Libmms uses the same vulnerable code.

Update :

The previous update for libmms had an incorrect/incomplete patch. This update includes a more complete fix for the issue.

ID	Name	Product	Family	Severity
27891	Ubuntu 5.04 / 5.10 / 6.06 LTS : libmms, xine-lib vulnerabilities (USN-315-1)	Nessus	Ubuntu Local Security Checks	medium
27884	Ubuntu 5.10 : libmms vulnerability (USN-309-1)	Nessus	Ubuntu Local Security Checks	medium
24665	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 9.1 : xine-lib (SSA:2006-357-05)	Nessus	Slackware Local Security Checks	high
23793	FreeBSD : libxine -- multiple buffer overflow vulnerabilities (1b043693-8617-11db-93b2-000e35248ad7)	Nessus	FreeBSD Local Security Checks	high
22456	FreeBSD : libmms -- stack-based buffer overflow (f6bff909-4a26-11db-a4cc-000a48049292)	Nessus	FreeBSD Local Security Checks	medium
22083	GLSA-200607-07 : xine-lib: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
22042	Mandrake Linux Security Advisory : xine-lib (MDKSA-2006:121)	Nessus	Mandriva Local Security Checks	medium
22013	Mandrake Linux Security Advisory : libmms (MDKSA-2006:117-1)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2006-2200

critical

Tenable Plugins

medium

medium

high

high

medium

medium

medium

medium