[ GLSA 200408-01 ] MPlayer: GUI filename handling overflow

From: Thierry Carrez (koon_at_gentoo.org)
Date: 08/01/04

  • Next message: Juan Manuel Pascual: "OPEN3S - Local Privilege Elevation through Oracle products (Unix Platform)" 
    Date: Sun, 01 Aug 2004 12:01:54 +0200
To: gentoo-announce@lists.gentoo.org

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 200408-01
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                http://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Severity: Normal
         Title: MPlayer: GUI filename handling overflow
          Date: August 01, 2004
          Bugs: #55456
            ID: 200408-01

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    When compiled with GUI support MPlayer is vulnerable to a remotely
    exploitable buffer overflow attack.

    Background
    ==========

    MPlayer is a media player capable of handling multiple multimedia file
    formats.

    Affected packages
    =================

        -------------------------------------------------------------------
         Package / Vulnerable / Unaffected
        -------------------------------------------------------------------
      1 media-video/mplayer < 1.0_pre4-r7 >= 1.0_pre4-r7

    Description
    ===========

    The MPlayer GUI code contains several buffer overflow vulnerabilities,
    and at least one in the TranslateFilename() function is exploitable.

    Impact
    ======

    By enticing a user to play a file with a carefully crafted filename an
    attacker could execute arbitrary code with the permissions of the user
    running MPlayer.

    Workaround
    ==========

    To work around this issue, users can compile MPlayer without GUI
    support by disabling the gtk USE flag. All users are encouraged to
    upgrade to the latest available version of MPlayer.

    Resolution
    ==========

    All MPlayer users should upgrade to the latest version:

        # emerge sync

        # emerge -pv ">=media-video/mplayer-1.0_pre4-r7"
        # emerge ">=media-video/mplayer-1.0_pre4-r7"

    References
    ==========

      [ 1 ] Bugtraq Announcement
            http://www.securityfocus.com/bid/10615/
      [ 2 ] Open-Security Announcement
            http://www.open-security.org/advisories/5

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

        http://security.gentoo.org/glsa/glsa-200408-01.xml

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users machines is of utmost
    importance to us. Any security concerns should be addressed to
    security@gentoo.org or alternatively, you may file a bug at
    http://bugs.gentoo.org.

    License
    =======

    Copyright 2004 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    http://creativecommons.org/licenses/by-sa/1.0

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.4 (GNU/Linux)
    Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

    iD8DBQFBDL+RvcL1obalX08RAvsoAKCa7xHOPPs+5E8kNoTvVcOYQIbCvwCeIDi6
    SlzDBE5aEtx+3UvEFCh5CVo=
    =n4Pk
    -----END PGP SIGNATURE-----

  • Next message: Juan Manuel Pascual: "OPEN3S - Local Privilege Elevation through Oracle products (Unix Platform)"

    Relevant Pages

    • [Full-Disclosure] [ GLSA 200408-01 ] MPlayer: GUI filename handling overflow
      ... exploitable buffer overflow attack. ... MPlayer is a media player capable of handling multiple multimedia file ... The MPlayer GUI code contains several buffer overflow vulnerabilities, ... Security is a primary focus of Gentoo Linux and ensuring the ...
      (Full-Disclosure)
    • [ GLSA 200408-01 ] MPlayer: GUI filename handling overflow
      ... exploitable buffer overflow attack. ... MPlayer is a media player capable of handling multiple multimedia file ... The MPlayer GUI code contains several buffer overflow vulnerabilities, ... Security is a primary focus of Gentoo Linux and ensuring the ...
      (Full-Disclosure)
    • Re: VCD no go with MPlayer.
      ... but my problems with MPlayer in the GUI is still the ... In GUI I still get the following: ... but if you play a DVD from the command line MPlayer will list ... I think it's a similar problem, Flash needs to be told to use the sound ...
      (Debian-User)
    • Re: Media Player
      ... Genauso wenig ist mplayer ... dass das GUI ein separater Kindprozess sein ... die Kommunikation zum Kind ...
      (de.comp.os.unix.apps.misc)
    • Re: Replacement for Media Player Classic?
      ... > part everything is going very smooth, except for playing media files. ... > windows I have always used the very powerful Media Player Classic ... I'm in the Mplayer camp and except for some "wmv formats" I think Mplayer ... and recording/encoding but not gui. ...
      (alt.os.linux)
    • Quantcast