Multiple stack-based buffer overflows in stream/stream_cddb.c in MPlayer before 1.0rc1try3 allow remote attackers to execute arbitrary code via a CDDB entry with a long (1) album title or (2) category.

The remote host is affected by the vulnerability described in GLSA-200707-07 (MPlayer: Multiple buffer overflows)

    Stefan Cornelius and Reimar Doffinger of Secunia Research discovered     several boundary errors in the functions cddb_query_parse(),     cddb_parse_matches_list() and cddb_read_parse(), each allowing for a     stack-based buffer overflow.
  Impact :

    A remote attacker could entice a user to open a specially crafted file     with malicious CDDB entries, possibly resulting in the execution of     arbitrary code with the privileges of the user running MPlayer.
  Workaround :

    There is no known workaround at this time.

Multiple stack-based buffer overflows in stream/stream_cddb.c in MPlayer before 1.0rc1try3 allow remote attackers to execute arbitrary code via a CDDB entry with a long (1) album title or (2) category.

Updated packages have been patched to prevent this issue.

Stefan Cornelius and Reimar Doeffinger discovered that the MPlayer movie player performs insufficient boundary checks when accessing CDDB data, which might lead to the execution of arbitrary code.

The oldstable distribution (sarge) doesn't include MPlayer packages.

Mplayer Team reports :

A stack overflow was found in the code used to handle cddb queries.
When copying the album title and category, no checking was performed on the size of the strings before storing them in a fixed-size array.
A malicious entry in the database could trigger a stack overflow in the program, leading to arbitrary code execution with the uid of the user running MPlayer.

ID	Name	Product	Family	Severity
25789	GLSA-200707-07 : MPlayer: Multiple buffer overflows	Nessus	Gentoo Local Security Checks	high
25685	Mandrake Linux Security Advisory : mplayer (MDKSA-2007:143)	Nessus	Mandriva Local Security Checks	high
25557	Debian DSA-1313-1 : mplayer - buffer overflow	Nessus	Debian Local Security Checks	high
25451	FreeBSD : mplayer -- cddb stack overflow (3ac80dd2-14df-11dc-bcfc-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2007-2948

critical

Tenable Plugins

high

high

high

high