Bugzilla – Bug 64325
VUL-0: CVE-2004-1310: MPlayer buffer overflow
Last modified: 2021-09-28 08:17:35 UTC
We received the following report via vendor-sec. The issue is public. MPlayer apparently is on SLD From djb@cr.yp.to Wed Dec 15 14:21:17 2004 Date: 15 Dec 2004 08:18:11 -0000 From: D. J. Bernstein <djb@cr.yp.to> To: securesoftware@list.cr.yp.to, mplayer-users@mplayerhq.hu Subject: [remote] [control] MPlayer 1.0pre5 get_header overflows data buffer Ariel Berkman, a student in my Fall 2004 UNIX Security Holes course, has discovered a remotely exploitable security hole in MPlayer. I'm publishing this notice, but all the discovery credits should be assigned to Berkman. You are at risk if you use MPlayer to play an ASF video stream from the web (or from any other source that could be controlled by an attacker). Whoever provides that stream then has complete control over your account: he can read and modify your files, watch the programs you're running, etc. Proof of concept: On an x86 computer running FreeBSD 4.10 with ucspi-tcp installed, type wget http://ftp5.mplayerhq.hu/mplayer/releases/MPlayer-1.0pre5.tar.bz2 bunzip2 < MPlayer-1.0pre5.tar.bz2 | tar -xf - cd MPlayer-1.0pre5 ./configure gmake to download and compile the MPlayer program, version 1.0pre5 (current). Then save the file 17-s.c attached to this message, and type gcc -o 17-s 17-s.c tcpserver 0 1755 ./17-s & ./mplayer mmst://127.0.0.1/new_video.asf with the unauthorized result that a file named x is removed from the current directory. (I tested this with a 538-byte environment, as reported by printenv | wc -c.) Here's the bug: In asf_mmst_streaming.c, get_header() uses get_data() to copy an input-specified amount of data into a 102400-byte data[] array. ---D. J. Bernstein, Associate Professor, Department of Mathematics, Statistics, and Computer Science, University of Illinois at Chicago [ Part 2, Text/PLAIN 103 lines. ] [ Unable to print this part. ]
Is this exploit covered by official patch http://www.mplayerhq.hu/MPlayer/patches/mmst_fix_20041215.diff ?
Not sure, whether this bug is covered by mmst_fix_20041215.diff. Cummulative patch applied for STABLE and PLUS. For 8.2 and sles9-slec applied only: bmp_fix_20041215_backport.diff, mmst_fix_20041215_backport.diff, mp3_fix_20041215.diff, pnm_fix_20041215.diff. Patch rtsp_fix_20041215.diff not applied, code seems to be completely different. For 8.1 applied only: bmp_fix_20041215_backport.diff, mmst_fix_20041215_backport.diff, mp3_fix_20041215.diff. Patches rtsp_fix_20041215.diff, code seems to be completely different, pnm_fix_20041215.diff, code is probably net yet there. Please verify my backports. For 9.0, 9.1, 9.2 no porting of patch was done! It was never approved for distribution and never tested, or even not compile. Maybe the code should be dropped from there.
Patch submitted altogether with fix of: bug 64365 bug 64367 Not sure, whether applied patch covers this issue. Reassigning to security team.
====================================================== Candidate: CAN-2004-1285 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1285 Reference: MISC:http://tigger.uic.edu/~jlongs2/holes/mplayer.txt Buffer overflow in the get_header function in asf_mmst_streaming.c for MPlayer 1.0pre5 allows remote attackers to execute arbitrary code via a crafted ASF video stream.
http://www.mplayerhq.hu/MPlayer/patches/mmst_fix_20041215.diff adds packet_len checking to asf_mmst_streaming.c. It seems to be the same issue. Please verify my patch backport.
Yes, mmst_fix_20041215.diff seems to be the fix for the bug djb is describing. For 8.1 and 8.2, mmst_fix_20041215_backport.diff looks the same as mmst_fix_20041215.diff, only the line-numbers differ. So I assume its a correct backport. The BMP fix is really funny, it removes the BMP-handler from mplayer. However, its the official patch from MPlayer-team, so bmp_fix_20041215_backport.diff is correct as well. Go ahead with the patches and the process.
Fixed packages are waiting in /work/src/done since December 20th. I do not plan to fix 9.0, 9.1 and 9.2. These version were never released nor tested and cannot leave SuSE. Maybe it should be dropped and SuSE internal users should use only version from PLUS.
Created attachment 27714 [details] patchinfo for box ...
Created attachment 27715 [details] patchinfo for SLES ...
SM-tracker-161. Please tell suse-dist to build packages. the patchinfos are in place.
*** Bug 64366 has been marked as a duplicate of this bug. ***
packages approved
CVE-2004-1310 for mmst problem
CVE-2004-1310: CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)