[UNIX] MPlayer Encoded URL Heap Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 03/31/04

  • Next message: SecuriTeam: "[TOOL] PYthon MAil VIrus Scanner" 
    To: list@securiteam.com
Date: 31 Mar 2004 10:40:48 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      MPlayer Encoded URL Heap Overflow
    ------------------------------------------------------------------------

    SUMMARY

     A remotely exploitable buffer overflow vulnerability was found in
    <http://www.mplayerhq.hu/> MPlayer. A malicious host can craft a harmful
    HTTP header ("Location:"), and trick MPlayer into executing arbitrary code
    upon parsing that header.

    DETAILS

    MPlayer versions affected:
     * MPlayer 0.90pre series
     * MPlayer 0.90rc series
     * MPlayer 0.90
     * MPlayer 0.91
     * MPlayer 1.0pre1
     * MPlayer 1.0pre2
     * MPlayer 1.0pre3

    MPlayer versions unaffected:
     * MPlayer releases before 0.60pre1
     * MPlayer 0.92.1
     * MPlayer 1.0pre3try2
     * MPlayer 0_92 CVS
     * MPlayer HEAD CVS

    Whilst requesting a file from a web server, MPlayer allocates a buffer to
    store the URL escaped representation of a string. Not enough memory is
    allocated here, so a heap overflow may occur. This means that, for
    example, if a user issues the following command:
    $ mplayer http://www.somesite.com/somefile.mpg

    The owner of www.somesite.com may be able to execute code under the
    privileges of the user running the command.

    Vulnerable code:
    The faulty code is here:

    libmpdemux/http.c:http_build_request (line 178):
       if( http_hdr->uri==NULL ) http_set_uri( http_hdr, "/");
       else {
          uri = (char*)malloc(strlen(http_hdr->uri)*2); [1]
          if( uri==NULL ) {
             mp_msg(MSGT_NETWORK,MSGL_ERR,"Memory allocation failed\n");
             return NULL;
         }
         url_escape_string( uri, http_hdr->uri ); [2]

    URL escaping a string may cause one character to be replaced by three,
    e.g. a space character replaced by %22, so the allocation at [1] does not
    allocate enough memory and the buffer may be overflowed at [2].

    A malicious web server may exploit this bug by redirecting a client to a
    URL containing many un-escaped characters (thus triggering the bug) using
    the Location HTTP header.

    Exploit:
    Exploitation of this bug is tricky, although not impossible, for a few
    reasons:

    1) The code is called near the start of the program and the buffer is
    usually larger than any previously deallocated buffer. This means that we
    are usually overflowing into the wilderness chunk.

    2) Non-printable characters are URL escaped, so standard dlmalloc fd and
    bk overwriting won't work (the addresses we overwrite fd and bk with will
    be escaped)

    To test if you are using a vulnerable version of MPlayer, issue the
    following command:
    $ mplayer http://`perl -e 'print "\""x1024;'`

    If MPlayer dies with a segmentation fault, you're vulnerable.

    Fix:
    The vendor has released a patch. Apply this patch or upgrade to a
    non-vulnerable version of MPlayer (see vendor's advisory for details on
    vulnerable and non-vulnerable versions).

    References:
    Vendor's patch: <http://www.mplayerhq.hu/MPlayer/patches/vuln02-fix.diff>
    http://www.mplayerhq.hu/MPlayer/patches/vuln02-fix.diff
    Vendor's advisory: <http://www.mplayerhq.hu/homepage/design6/news.html>
    http://www.mplayerhq.hu/homepage/design6/news.html

    Thanks to the MPlayer team for such a quick response and fix.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:blexim@hush.com> blexim.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] PYthon MAil VIrus Scanner"

    Relevant Pages

    • [UNIX] Remote Buffer Overflow Vulnerabilities in Real RTSP Streaming
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... joint advisory by the MPlayer and xine teams as the code in question is ... RTSP input plugin, ...
      (Securiteam)
    • [NEWS] MPlayer Buffer Overflow (asf_streaming)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... and trick MPlayer into executing arbitrary code upon parsing ... fully controllable EIP buffer overflow. ...
      (Securiteam)
    • [NEWS] MPlayer "ASF" File Handling Multiple Integer Overflows
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Improper handling of ASF files allows attackers to DoS MPlayer. ... The problem happen when allocating memory to copy data from an .asf file. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [UNIX] Sun Microsystems Solaris ld.so doprf() Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sun Microsystems Solaris ld.so 'doprf' Buffer Overflow Vulnerability ...
      (Securiteam)
    • [NT] Microsoft Outlook Express NNTP "LIST" Buffer Overflow (MS05-030)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The NNTP news reader embedded in Outlook Express is vulnerable to buffer ... Remote exploitation of a buffer overflow vulnerability in the news reader ...
      (Securiteam)