Array index error in the gst_qtp_trak_handler function in gst/qtdemux/qtdemux.c in GStreamer Plug-ins (aka gstreamer-plugins) 0.6.0 allows remote attackers to have an unknown impact via a crafted QuickTime media file.

From Red Hat Security Advisory 2009:0269 :

Updated gstreamer-plugins packages that fix one security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The gstreamer-plugins package contains plug-ins used by the GStreamer streaming-media framework to support a wide variety of media types.

An array indexing error was found in the GStreamer's QuickTime media file format decoding plug-in. An attacker could create a carefully-crafted QuickTime media .mov file that would cause an application using GStreamer to crash or, potentially, execute arbitrary code if played by a victim. (CVE-2009-0398)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
After installing the update, all applications using GStreamer (such as nautilus-media) must be restarted for the changes to take effect.

An array indexing error was found in the GStreamer's QuickTime media file format decoding plug-in. An attacker could create a carefully-crafted QuickTime media .mov file that would cause an application using GStreamer to crash or, potentially, execute arbitrary code if played by a victim. (CVE-2009-0397, CVE-2009-0398)

After installing the update, all applications using GStreamer (such as nautilus-media) must be restarted for the changes to take effect.

Updated gstreamer-plugins packages that fix one security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The gstreamer-plugins package contains plug-ins used by the GStreamer streaming-media framework to support a wide variety of media types.

An array indexing error was found in the GStreamer's QuickTime media file format decoding plug-in. An attacker could create a carefully-crafted QuickTime media .mov file that would cause an application using GStreamer to crash or, potentially, execute arbitrary code if played by a victim. (CVE-2009-0398)

All users of gstreamer-plugins are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
After installing the update, all applications using GStreamer (such as nautilus-media) must be restarted for the changes to take effect.

ID	Name	Product	Family	Severity
67802	Oracle Linux 3 : gstreamer-plugins (ELSA-2009-0269)	Nessus	Oracle Linux Local Security Checks	high
60531	Scientific Linux Security Update : gstreamer-plugins on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
35615	RHEL 3 : gstreamer-plugins (RHSA-2009:0269)	Nessus	Red Hat Local Security Checks	high
35602	CentOS 3 : gstreamer-plugins (CESA-2009:0269)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2009-0398

high

Tenable Plugins

high

high

high

high