Buffer overflow in the HTTP Plugin (xineplug_inp_http.so) for xine-lib 1.1.1 allows remote attackers to cause a denial of service (application crash) via a long reply from an HTTP server, as demonstrated using gxine 0.5.6.

Federico L. Bossi Bonin discovered a buffer overflow in the HTTP input module. By tricking an user into opening a malicious remote media location, a remote attacker could exploit this to crash Xine library frontends (like totem-xine, gxine, or xine-ui) and possibly even execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Missing length checks in the HTTP plugin could lead to a buffer overflow on the heap (CVE-2006-2802).

Federico L. Bossi Bonin discovered a buffer overflow in the HTTP Plugin in xine-lib, the xine video/media player library, that could allow a remote attacker to cause a denial of service.

The remote host is affected by the vulnerability described in GLSA-200609-08 (xine-lib: Buffer overflows)

    xine-lib contains buffer overflows in the processing of AVI.
    Additionally, xine-lib is vulnerable to a buffer overflow in the HTTP     plugin (xineplug_inp_http.so) via a long reply from an HTTP server.
  Impact :

    An attacker could trigger the buffer overflow vulnerabilities by     enticing a user to load a specially crafted AVI file in xine. This     might result in the execution of arbitrary code with the rights of the     user running xine. Additionally, a remote HTTP server serving a xine     client a specially crafted reply could crash xine and possibly execute     arbitrary code.
  Workaround :

    There is no known workaround at this time.

New xine-lib packages are available for Slackware 10.2 and -current to fix security issues.

A buffer overflow in the HTTP Plugin (xineplug_inp_http.so) for xine-lib 1.1.1 allows remote attackers to cause a denial of service (application crash) via a long reply from an HTTP server, as demonstrated using gxine 0.5.6. (CVE-2006-2802)

In addition, a possible buffer overflow exists in the AVI demuxer, similar in nature to CVE-2006-1502 for MPlayer. The Corporate 3 release of xine-lib does not have this issue.

The updated packages have been patched to correct these issues.

A Secunia Advisory reports :

Federico L. Bossi Bonin has discovered a weakness in xine-lib, which can be exploited by malicious people to crash certain applications on a user's system.

The weakness is cause due to a heap corruption within the 'xineplug_inp_http.so' plugin when handling an overly large reply from the HTTP server. This can be exploited to crash an application that uses the plugin (e.g. gxine).

ID	Name	Product	Family	Type	Severity
27867	Ubuntu 5.04 / 5.10 / 6.06 LTS : xine-lib vulnerability (USN-295-1)	Nessus	Ubuntu Local Security Checks	Local	medium
27484	openSUSE 10 Security Update : xine-lib (xine-lib-1599)	Nessus	SuSE Local Security Checks	Local	medium
22647	Debian DSA-1105-1 : xine-lib - buffer overflow	Nessus	Debian Local Security Checks	Local	medium
22353	GLSA-200609-08 : xine-lib: Buffer overflows	Nessus	Gentoo Local Security Checks	Local	medium
22101	Slackware 10.2 / current : xine-lib (SSA:2006-207-04)	Nessus	Slackware Local Security Checks	Local	high
21752	Mandrake Linux Security Advisory : xine-lib (MDKSA-2006:108)	Nessus	Mandriva Local Security Checks	Local	medium
21700	FreeBSD : libxine -- buffer overflow vulnerability (107e2ee5-f941-11da-b1fa-020039488e34)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2006-2802

high

Tenable Plugins

medium

medium

medium

medium

high

medium

medium