Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow.

From Red Hat Security Advisory 2009:1123 :

Updated gstreamer-plugins-good packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. GStreamer Good Plug-ins is a collection of well-supported, good quality GStreamer plug-ins.

Multiple integer overflow flaws, that could lead to a buffer overflow, were found in the GStreamer Good Plug-ins PNG decoding handler. An attacker could create a specially crafted PNG file that would cause an application using the GStreamer Good Plug-ins library to crash or, potentially, execute arbitrary code as the user running the application when parsed. (CVE-2009-1932)

All users of gstreamer-plugins-good are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the update, all applications using GStreamer Good Plug-ins (such as some media playing applications) must be restarted for the changes to take effect.

Multiple integer overflow flaws, that could lead to a buffer overflow, were found in the GStreamer Good Plug-ins PNG decoding handler. An attacker could create a specially crafted PNG file that would cause an application using the GStreamer Good Plug-ins library to crash or, potentially, execute arbitrary code as the user running the application when parsed. (CVE-2009-1932)

After installing the update, all applications using GStreamer Good Plug-ins (such as some media playing applications) must be restarted for the changes to take effect.

It has been discovered that gst-plugins-good0.10, the GStreamer plugins from the 'good' set, are prone to an integer overflow, when processing a large PNG file. This could lead to the execution of arbitrary code.

Specially crafted files could cause integer overflows in the PNG decoding module of GStreamer (CVE-2009-1932).

Updated gstreamer-plugins-good packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. GStreamer Good Plug-ins is a collection of well-supported, good quality GStreamer plug-ins.

Multiple integer overflow flaws, that could lead to a buffer overflow, were found in the GStreamer Good Plug-ins PNG decoding handler. An attacker could create a specially crafted PNG file that would cause an application using the GStreamer Good Plug-ins library to crash or, potentially, execute arbitrary code as the user running the application when parsed. (CVE-2009-1932)

All users of gstreamer-plugins-good are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the update, all applications using GStreamer Good Plug-ins (such as some media playing applications) must be restarted for the changes to take effect.

Specially crafted files could cause integer overflows in the PNG decoding module of GStreamer. (CVE-2009-1932)

The remote host is affected by the vulnerability described in GLSA-200907-11 (GStreamer plug-ins: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been reported in several GStreamer     plug-ins:
    Tobias Klein reported two heap-based buffer overflows and an array     index error in the qtdemux_parse_samples() function in gst-plugins-good     when processing a QuickTime media .mov file (CVE-2009-0386,     CVE-2009-0387, CVE-2009-0397).
    Thomas Hoger of the Red Hat Security Response Team reported an integer     overflow that can lead to a heap-based buffer overflow in the     gst_vorbis_tag_add_coverart() function in gst-plugins-base when     processing COVERART tags (CVE-2009-0586).
    Tielei Wang of ICST-ERCIS, Peking University reported multiple integer     overflows leading to buffer overflows in gst-plugins-libpng when     processing a PNG file (CVE-2009-1932).
  Impact :

    A remote attacker could entice a user or automated system using a     GStreamer plug-in to process a specially crafted file, resulting in the     execution of arbitrary code or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Tielei Wang discovered that GStreamer Good Plugins did not correctly handle malformed PNG image files. If a user were tricked into opening a crafted PNG image file with a GStreamer application, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PNG file, which triggers a buffer overflow (CVE-2009-1932).

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

ID	Name	Product	Family	Severity
67879	Oracle Linux 5 : gstreamer-plugins-good (ELSA-2009-1123)	Nessus	Oracle Linux Local Security Checks	medium
60602	Scientific Linux Security Update : gstreamer-plugins-good on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
44704	Debian DSA-1839-1 : gst-plugins-good0.10 - integer overflow	Nessus	Debian Local Security Checks	medium
43813	openSUSE Security Update : gstreamer-0_10-plugins-good (gstreamer-0_10-plugins-good-1717)	Nessus	SuSE Local Security Checks	medium
43761	CentOS 5 : gstreamer-plugins-good (CESA-2009:1123)	Nessus	CentOS Local Security Checks	medium
42004	openSUSE 10 Security Update : gstreamer010-plugins-good (gstreamer010-plugins-good-6295)	Nessus	SuSE Local Security Checks	medium
41518	SuSE 10 Security Update : gstreamer (ZYPP Patch Number 6293)	Nessus	SuSE Local Security Checks	medium
41401	SuSE 11 Security Update : gstreamer (SAT Patch Number 984)	Nessus	SuSE Local Security Checks	medium
40228	openSUSE Security Update : gstreamer-0_10-plugins-good (gstreamer-0_10-plugins-good-989)	Nessus	SuSE Local Security Checks	medium
39978	openSUSE Security Update : gstreamer-0_10-plugins-good (gstreamer-0_10-plugins-good-989)	Nessus	SuSE Local Security Checks	medium
39782	GLSA-200907-11 : GStreamer plug-ins: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
39526	RHEL 5 : gstreamer-plugins-good (RHSA-2009:1123)	Nessus	Red Hat Local Security Checks	medium
39491	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : gst-plugins-good0.10 vulnerability (USN-789-1)	Nessus	Ubuntu Local Security Checks	medium
39322	Mandriva Linux Security Advisory : gstreamer0.10-plugins-good (MDVSA-2009:130-1)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2009-1932

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium