Integer signedness error in the fourxm_read_header function in libavformat/4xm.c in FFmpeg before revision 16846 allows remote attackers to execute arbitrary code via a malformed 4X movie file with a large current_track value, which triggers a NULL pointer dereference.

Vulnerabilities have been discovered and corrected in ffmpeg :

  - The ffmpeg lavf demuxer allows user-assisted attackers     to cause a denial of service (application crash) via a     crafted GIF file (CVE-2008-3230)

  - FFmpeg 0.4.9, as used by MPlayer, allows     context-dependent attackers to cause a denial of service     (memory consumption) via unknown vectors, aka a Tcp/udp     memory leak. (CVE-2008-4869)

  - Integer signedness error in the fourxm_read_header     function in libavformat/4xm.c in FFmpeg before revision     16846 allows remote attackers to execute arbitrary code     via a malformed 4X movie file with a large current_track     value, which triggers a NULL pointer dereference     (CVE-2009-0385)

The updated packages fix this issue.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

xine developers report :

- Fix another possible int overflow in the 4XM demuxer. (ref.
TKADV2009-004, CVE-2009-0385)

- Fix an integer overflow in the Quicktime demuxer.

Several vulnerabilities have been discovered in mplayer, a movie player for Unix-like systems. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0385     It was discovered that watching a malformed 4X movie     file could lead to the execution of arbitrary code.

  - CVE-2008-4866     It was discovered that multiple buffer overflows could     lead to the execution of arbitrary code.

  - CVE-2008-5616     It was discovered that watching a malformed TwinVQ file     could lead to the execution of arbitrary code.

Several vulnerabilities have been discovered in ffmpeg, a multimedia player, server and encoder. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0385     It was discovered that watching a malformed 4X movie     file could lead to the execution of arbitrary code.

  - CVE-2008-3162     It was discovered that using a crafted STR file can lead     to the execution of arbitrary code.

It was discovered that FFmpeg did not correctly handle certain malformed Ogg Media (OGM) files. If a user were tricked into opening a crafted Ogg Media file, an attacker could cause the application using FFmpeg to crash, leading to a denial of service. (CVE-2008-4610)

It was discovered that FFmpeg did not correctly handle certain parameters when creating DTS streams. If a user were tricked into processing certain commands, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.10. (CVE-2008-4866)

It was discovered that FFmpeg did not correctly handle certain malformed DTS Coherent Acoustics (DCA) files. If a user were tricked into opening a crafted DCA file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4867)

It was discovered that FFmpeg did not correctly handle certain malformed 4X movie (4xm) files. If a user were tricked into opening a crafted 4xm file, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0385).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Maintenance release. Fixes two security problems (CVE-2009-0385, CVE-2009-1274) and a few miscellaneous bugs. See the upstream changelog for details:
http://sourceforge.net/project/shownotes.php?group_id=9655&release_id= 673233

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New xine-lib packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix security issues.

The remote host is affected by the vulnerability described in GLSA-200903-33 (FFmpeg: Multiple vulnerabilities)

    Multiple vulnerabilities were found in FFmpeg:
    astrange     reported a stack-based buffer overflow in the str_read_packet() in     libavformat/psxstr.c when processing .str files (CVE-2008-3162).
    Multiple buffer overflows in libavformat/utils.c     (CVE-2008-4866).
    A buffer overflow in libavcodec/dca.c     (CVE-2008-4867).
    An unspecified vulnerability in the     avcodec_close() function in libavcodec/utils.c (CVE-2008-4868).
    Unspecified memory leaks (CVE-2008-4869).
    Tobias Klein     repoerted a NULL pointer dereference due to an integer signedness error     in the fourxm_read_header() function in libavformat/4xm.c     (CVE-2009-0385).
  Impact :

    A remote attacker could entice a user to open a specially crafted media     file, possibly leading to the execution of arbitrary code with the     privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Secunia reports :

Tobias Klein has reported a vulnerability in FFmpeg, which potentially can be exploited by malicious people to compromise an application using the library.

The vulnerability is caused due to a signedness error within the 'fourxm_read_header()' function in libavformat/4xm.c. This can be exploited to corrupt arbitrary memory via a specially crafted 4xm file.

ID	Name	Product	Family	Severity
42809	Mandriva Linux Security Advisory : ffmpeg (MDVSA-2009:297-1)	Nessus	Mandriva Local Security Checks	critical
38801	FreeBSD : libxine -- multiple vulnerabilities (48e14d86-42f1-11de-ad22-000e35248ad7)	Nessus	FreeBSD Local Security Checks	high
38641	Debian DSA-1782-1 : mplayer - several vulnerabilities	Nessus	Debian Local Security Checks	critical
38640	Debian DSA-1781-1 : ffmpeg-debian - several vulnerabilities	Nessus	Debian Local Security Checks	high
38037	Ubuntu 7.10 / 8.04 LTS / 8.10 : ffmpeg, ffmpeg-debian vulnerabilities (USN-734-1)	Nessus	Ubuntu Local Security Checks	critical
37865	Fedora 10 : xine-lib-1.1.16.3-1.fc10 (2009-3433)	Nessus	Fedora Local Security Checks	high
36124	Fedora 9 : xine-lib-1.1.16.3-1.fc9 (2009-3428)	Nessus	Fedora Local Security Checks	high
36106	Slackware 12.0 / 12.1 / 12.2 / current : xine-lib (SSA:2009-098-03)	Nessus	Slackware Local Security Checks	high
35969	GLSA-200903-33 : FFmpeg: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
35938	FreeBSD : ffmpeg -- 4xm processing memory corruption vulnerability (6733e1bf-125f-11de-a964-0030843d3802)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2009-0385

high

Tenable Plugins

critical

high

critical

high

critical

high

high

high

critical

high