Stack-based buffer overflow in the str_read_packet function in libavformat/psxstr.c in FFmpeg before r13993 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted STR file that interleaves audio and video sectors.

Several vulnerabilities have been discovered in ffmpeg, a multimedia player, server and encoder. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0385     It was discovered that watching a malformed 4X movie     file could lead to the execution of arbitrary code.

  - CVE-2008-3162     It was discovered that using a crafted STR file can lead     to the execution of arbitrary code.

A vulnerability was found in how ffmpeg handled STR file demuxing. If a user were tricked into processing a malicious STR file, a remote attacker could execute arbitrary code with user privileges via applications linked against ffmpeg (CVE-2008-3162).

The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200903-33 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities were found in FFmpeg:
    astrange     reported a stack-based buffer overflow in the str_read_packet() in     libavformat/psxstr.c when processing .str files (CVE-2008-3162).
    Multiple buffer overflows in libavformat/utils.c     (CVE-2008-4866).
    A buffer overflow in libavcodec/dca.c     (CVE-2008-4867).
    An unspecified vulnerability in the     avcodec_close() function in libavcodec/utils.c (CVE-2008-4868).
    Unspecified memory leaks (CVE-2008-4869).
    Tobias Klein     repoerted a NULL pointer dereference due to an integer signedness error     in the fourxm_read_header() function in libavformat/4xm.c     (CVE-2009-0385).
  Impact :

    A remote attacker could entice a user to open a specially crafted media     file, possibly leading to the execution of arbitrary code with the     privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Secunia reports :

The vulnerability is caused due to a boundary error within the 'str_read_packet()' function in libavformat/psxstr.c. This can be exploited to cause a heap-based buffer overflow via a specially crafted STR file.

The remote host is affected by the vulnerability described in GLSA-200901-07 (MPlayer: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in MPlayer:
    A     stack-based buffer overflow was found in the str_read_packet() function     in libavformat/psxstr.c when processing crafted STR files that     interleave audio and video sectors (CVE-2008-3162).
    Felipe     Andres Manzano reported multiple integer underflows in the     demux_real_fill_buffer() function in demux_real.c when processing     crafted Real Media files that cause the stream_read() function to read     or write arbitrary memory (CVE-2008-3827).
    Tobias Klein     reported a stack-based buffer overflow in the demux_open_vqf() function     in libmpdemux/demux_vqf.c when processing malformed TwinVQ files     (CVE-2008-5616).
  Impact :

    A remote attacker could entice a user to open a specially crafted STR,     Real Media, or TwinVQ file to execute arbitrary code or cause a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

It was discovered that ffmpeg did not correctly handle STR file demuxing. If a user were tricked into processing a malicious STR file, a remote attacker could execute arbitrary code with user privileges via applications linked against ffmpeg.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
38640	Debian DSA-1781-1 : ffmpeg-debian - several vulnerabilities	Nessus	Debian Local Security Checks	high
36794	Mandriva Linux Security Advisory : ffmpeg (MDVSA-2008:157)	Nessus	Mandriva Local Security Checks	high
35969	GLSA-200903-33 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
35401	FreeBSD : mplayer -- vulnerability in STR files processor (5ccb1c14-e357-11dd-a765-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
35355	GLSA-200901-07 : MPlayer: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
33759	Ubuntu 7.10 / 8.04 LTS : ffmpeg vulnerability (USN-630-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2008-3162

high

Tenable Plugins

high

high

critical

high

critical

high