Stack-based buffer overflow in the demux_nsf_send_chunk function in src/demuxers/demux_nsf.c in xine-lib 1.1.12 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long NSF title.

Specially crafted NSF files could potentially be exploited to execute arbitrary code. (CVE-2008-1878)

Specially crafted files or streams could potentially be abused to trick applications that support speex into executing arbitrary code.
(CVE-2008-1686)

Guido Landi found A stack-based buffer overflow in xine-lib that could allow a remote attacker to cause a denial of service (crash) and potentially execute arbitrary code via a long NSF title (CVE-2008-1878).

The updated packages have been patched to correct this issue.

Alin Rad Pop found an array index vulnerability in the SDP parser of xine-lib. If a user or automated system were tricked into opening a malicious RTSP stream, a remote attacker could possibly execute arbitrary code with the privileges of the user using the program (CVE-2008-0073).

The ASF demuxer in xine-lib did not properly check the length of ASF headers. If a user was tricked into opening a crafted ASF file, a remote attacker could possibly cause a denial of service or execute arbitrary code with the privileges of the user using the program (CVE-2008-1110).

The Matroska demuxer in xine-lib did not properly verify frame sizes, which could possibly lead to the execution of arbitrary code if a user opened a crafted ASF file (CVE-2008-1161).

Luigi Auriemma found multiple integer overflows in xine-lib. If a user was tricked into opening a crafted FLV, MOV, RM, MVE, MKV, or CAK file, a remote attacker could possibly execute arbitrary code with the privileges of the user using the program (CVE-2008-1482).

Guido Landi found A stack-based buffer overflow in xine-lib that could allow a remote attacker to cause a denial of service (crash) and potentially execute arbitrary code via a long NSF title (CVE-2008-1878).

The updated packages have been patched to correct this issue.

This release fixes multiple bugs and security issues: - DoS via corrupted Ogg files (CVE-2008-3231) - multiple possible buffer overflows detailed in oCERT-2008-008 For more details, see:
http://sourceforge.net/project/shownotes.php?release_id=619869&group_i d=9655 http://www.ocert.org/advisories/ocert-2008-008.html NOTE: A coordinated release with 3rd-party repos was not possible, so this update may result in dependency issues with currently-installed xine-lib-extras-* rpms. This temporary problem will be rectified asap.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Alin Rad Pop discovered an array index vulnerability in the SDP parser. If a user or automated system were tricked into opening a malicious RTSP stream, a remote attacker may be able to execute arbitrary code with the privileges of the user invoking the program.
(CVE-2008-0073)

Luigi Auriemma discovered that xine-lib did not properly check buffer sizes in the RTSP header-handling code. If xine-lib opened an RTSP stream with crafted SDP attributes, a remote attacker may be able to execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-0225, CVE-2008-0238)

Damian Frizza and Alfredo Ortega discovered that xine-lib did not properly validate FLAC tags. If a user or automated system were tricked into opening a crafted FLAC file, a remote attacker may be able to execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-0486)

It was discovered that the ASF demuxer in xine-lib did not properly check the length if the ASF header. If a user or automated system were tricked into opening a crafted ASF file, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-1110)

It was discovered that the Matroska demuxer in xine-lib did not properly verify frame sizes. If xine-lib opened a crafted ASF file, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2008-1161)

Luigi Auriemma discovered multiple integer overflows in xine-lib. If a user or automated system were tricked into opening a crafted FLV, MOV, RM, MVE, MKV or CAK file, a remote attacker may be able to execute arbitrary code with the privileges of the user invoking the program.
(CVE-2008-1482)

It was discovered that xine-lib did not properly validate its input when processing Speex file headers. If a user or automated system were tricked into opening a specially crafted Speex file, an attacker could create a denial of service or possibly execute arbitrary code as the user invoking the program. (CVE-2008-1686)

Guido Landi discovered a stack-based buffer overflow in xine-lib when processing NSF files. If xine-lib opened a specially crafted NSF file with a long NSF title, an attacker could create a denial of service or possibly execute arbitrary code as the user invoking the program.
(CVE-2008-1878).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200808-01 (xine-lib: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been discovered in xine-lib:
    Alin Rad Pop of Secunia reported an array indexing vulnerability in the     sdpplin_parse() function in the file input/libreal/sdpplin.c when     processing streams from RTSP servers that contain a large 'streamid'     SDP parameter (CVE-2008-0073).
    Luigi Auriemma reported multiple integer overflows that result in     heap-based buffer overflows when processing '.FLV', '.MOV' '.RM',     '.MVE', '.MKV', and '.CAK' files (CVE-2008-1482).
    Guido Landi reported a stack-based buffer overflow in the     demux_nsf_send_chunk() function when handling titles within NES Music     (.NSF) files (CVE-2008-1878).
  Impact :

    A remote attacker could entice a user to play a specially crafted video     file or stream with a player using xine-lib, potentially resulting in     the execution of arbitrary code with the privileges of the user running     the player.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been discovered in xine-lib, a library which supplies most of the application functionality of the xine multimedia player. The Common Vulnerabilities and Exposures project identifies the following three problems :

  - CVE-2008-1482     Integer overflow vulnerabilities exist in xine's FLV,     QuickTime, RealMedia, MVE and CAK demuxers, as well as     the EBML parser used by the Matroska demuxer. These     weaknesses allow an attacker to overflow heap buffers     and potentially execute arbitrary code by supplying a     maliciously crafted file of those types.

  - CVE-2008-1686     Insufficient input validation in the Speex     implementation used by this version of xine enables an     invalid array access and the execution of arbitrary code     by supplying a maliciously crafted Speex file.

  - CVE-2008-1878     Inadequate bounds checking in the NES Sound Format (NSF)     demuxer enables a stack-based buffer overflow and the     execution of arbitrary code through a maliciously     crafted NSF file.

Specially crafted NSF files could potentially be exploited to execute arbitrary code (CVE-2008-1878).

Specially crafted files or streams could potentially be abused to trick applications that support speex into executing arbitrary code (CVE-2008-1686).

- Bug #442882 - CVE-2008-1878 xine-lib: buffer overflow in     nsf demuxer

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
51767	SuSE 10 Security Update : xine (ZYPP Patch Number 5304)	Nessus	SuSE Local Security Checks	high
37454	Mandriva Linux Security Advisory : xine-lib (MDVSA-2008:177)	Nessus	Mandriva Local Security Checks	high
36948	Mandriva Linux Security Advisory : xine-lib (MDVSA-2008:178)	Nessus	Mandriva Local Security Checks	high
34136	Fedora 8 : xine-lib-1.1.15-1.fc8 (2008-7572)	Nessus	Fedora Local Security Checks	critical
33940	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : xine-lib vulnerabilities (USN-635-1)	Nessus	Ubuntu Local Security Checks	high
33831	GLSA-200808-01 : xine-lib: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
32435	Debian DSA-1586-1 : xine-lib - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
32393	SuSE 10 Security Update : xine-lib (ZYPP Patch Number 5205)	Nessus	SuSE Local Security Checks	high
32392	openSUSE 10 Security Update : xine-devel (xine-devel-5204)	Nessus	SuSE Local Security Checks	high
32096	Fedora 8 : xine-lib-1.1.12-2.fc8 (2008-3353)	Nessus	Fedora Local Security Checks	high
32091	Fedora 7 : xine-lib-1.1.11.1-1.fc7.2 (2008-3326)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2008-1878

critical

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high