Vulnerabilities > CVE-2009-0387 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Gstreamer Good Plug-Ins and Plug-Ins
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted Sync Sample (aka stss) atom data in a malformed QuickTime media .mov file, related to "mark keyframes."
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 4 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family Scientific Linux Local Security Checks NASL id SL_20090206_GSTREAMER_PLUGINS_GOOD_ON_SL5_X.NASL description Multiple heap buffer overflows and an array indexing error were found in the GStreamer last seen 2020-06-01 modified 2020-06-02 plugin id 60530 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60530 title Scientific Linux Security Update : gstreamer-plugins-good on SL5.x i386/x86_64 NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2009-0271.NASL description From Red Hat Security Advisory 2009:0271 : Updated gstreamer-plugins-good packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. GStreamer is a streaming media framework, based on graphs of filters which operate on media data. GStreamer Good Plug-ins is a collection of well-supported, GStreamer plug-ins of good quality released under the LGPL license. Multiple heap buffer overflows and an array indexing error were found in the GStreamer last seen 2020-06-01 modified 2020-06-02 plugin id 67804 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67804 title Oracle Linux 5 : gstreamer-plugins-good (ELSA-2009-0271) NASL family SuSE Local Security Checks NASL id SUSE_11_0_GSTREAMER-0_10-PLUGINS-GOOD-090218.NASL description gstreamer-0_10: several heap overflows (CVE-2009-0386, CVE-2009-0387,CVE-2009-0397) have been fixed. Remote attackers could exploit these to execute arbitrary code via QuickTime media files. last seen 2020-06-01 modified 2020-06-02 plugin id 39977 published 2009-07-21 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/39977 title openSUSE Security Update : gstreamer-0_10-plugins-good (gstreamer-0_10-plugins-good-540) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_37A365ED126911DEA9640030843D3802.NASL description Secunia reports : Tobias Klein has reported some vulnerabilities in GStreamer Good Plug-ins, which can potentially be exploited by malicious people to compromise a vulnerable system. A boundary error occurs within the last seen 2020-06-01 modified 2020-06-02 plugin id 35936 published 2009-03-17 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/35936 title FreeBSD : gstreamer-plugins-good -- multiple memory overflows (37a365ed-1269-11de-a964-0030843d3802) NASL family SuSE Local Security Checks NASL id SUSE_GSTREAMER010-PLUGINS-GOOD-6008.NASL description gstreamer-0_10: several heap overflows (CVE-2009-0386, CVE-2009-0387,CVE-2009-0397) have been fixed. Remote attackers could exploit these to execute arbitrary code via QuickTime media files. last seen 2020-06-01 modified 2020-06-02 plugin id 35741 published 2009-02-26 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/35741 title openSUSE 10 Security Update : gstreamer010-plugins-good (gstreamer010-plugins-good-6008) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2009-0271.NASL description Updated gstreamer-plugins-good packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. GStreamer is a streaming media framework, based on graphs of filters which operate on media data. GStreamer Good Plug-ins is a collection of well-supported, GStreamer plug-ins of good quality released under the LGPL license. Multiple heap buffer overflows and an array indexing error were found in the GStreamer last seen 2020-06-01 modified 2020-06-02 plugin id 35617 published 2009-02-09 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/35617 title RHEL 5 : gstreamer-plugins-good (RHSA-2009:0271) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-736-1.NASL description It was discovered that GStreamer Good Plugins did not correctly handle malformed Composition Time To Sample (ctts) atom data in Quicktime (mov) movie files. If a user were tricked into opening a crafted mov file, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0386) It was discovered that GStreamer Good Plugins did not correctly handle malformed Sync Sample (aka stss) atom data in Quicktime (mov) movie files. If a user were tricked into opening a crafted mov file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0387) It was discovered that GStreamer Good Plugins did not correctly handle malformed Time-to-sample (aka stts) atom data in Quicktime (mov) movie files. If a user were tricked into opening a crafted mov file, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0397). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 37956 published 2009-04-23 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/37956 title Ubuntu 7.10 / 8.04 LTS / 8.10 : gst-plugins-good0.10 vulnerabilities (USN-736-1) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1729.NASL description Several vulnerabilities have been found in gst-plugins-bad0.10, a collection of various GStreamer plugins. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0386 Tobias Klein discovered a buffer overflow in the quicktime stream demuxer (qtdemux), which could potentially lead to the execution of arbitrary code via crafted .mov files. - CVE-2009-0387 Tobias Klein discovered an array index error in the quicktime stream demuxer (qtdemux), which could potentially lead to the execution of arbitrary code via crafted .mov files. - CVE-2009-0397 Tobias Klein discovered a buffer overflow in the quicktime stream demuxer (qtdemux) similar to the issue reported in CVE-2009-0386, which could also lead to the execution of arbitrary code via crafted .mov files. last seen 2020-06-01 modified 2020-06-02 plugin id 35754 published 2009-03-03 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/35754 title Debian DSA-1729-1 : gst-plugins-bad0.10 - several vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2009-1343.NASL description - Mon Feb 2 2009 - Bastien Nocera <bnocera at redhat.com> - 0.10.8-10 - Patch for overflows in the QT demuxer (#481267) - Tue Aug 12 2008 Adam Jackson <ajax at redhat.com> 0.10.8-9 - gst-plugins-good-0.10.8-http-auth.patch: Fix http auth. (#457952) - Mon Jul 21 2008 Adam Jackson <ajax at redhat.com> 0.10.8-8 - gst-plugins-good-0.10.8-v4l2-progressive-fix.patch: Backport v4l2 interlace/progressive fixes. (#454534) - Thu Jun 19 2008 Adam Jackson <ajax at redhat.com> 0.10.8-7 - gst-plugins-good-0.10.8-speex-nego.patch: Backport speex channel and rate negotiation from 0.10.9. (#451391) - Tue Jun 17 2008 - Bastien Nocera <bnocera at redhat.com> - 0.10.8-6 - Really fix the default audio output not being correct - Tue Jun 3 2008 - Bastien Nocera <bnocera at redhat.com> - 0.10.8-5 - Fix compilation of the v4l2 plugin with newer kernels - Mon Jun 2 2008 - Bastien Nocera <bnocera at redhat.com> - 0.10.8-4 - Work-around bug that would set the default audio output to last seen 2020-06-01 modified 2020-06-02 plugin id 35734 published 2009-02-25 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/35734 title Fedora 9 : gstreamer-plugins-good-0.10.8-10.fc9 (2009-1343) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200907-11.NASL description The remote host is affected by the vulnerability described in GLSA-200907-11 (GStreamer plug-ins: User-assisted execution of arbitrary code) Multiple vulnerabilities have been reported in several GStreamer plug-ins: Tobias Klein reported two heap-based buffer overflows and an array index error in the qtdemux_parse_samples() function in gst-plugins-good when processing a QuickTime media .mov file (CVE-2009-0386, CVE-2009-0387, CVE-2009-0397). Thomas Hoger of the Red Hat Security Response Team reported an integer overflow that can lead to a heap-based buffer overflow in the gst_vorbis_tag_add_coverart() function in gst-plugins-base when processing COVERART tags (CVE-2009-0586). Tielei Wang of ICST-ERCIS, Peking University reported multiple integer overflows leading to buffer overflows in gst-plugins-libpng when processing a PNG file (CVE-2009-1932). Impact : A remote attacker could entice a user or automated system using a GStreamer plug-in to process a specially crafted file, resulting in the execution of arbitrary code or a Denial of Service. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 39782 published 2009-07-13 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/39782 title GLSA-200907-11 : GStreamer plug-ins: User-assisted execution of arbitrary code NASL family SuSE Local Security Checks NASL id SUSE_11_1_GSTREAMER-0_10-PLUGINS-GOOD-090218.NASL description gstreamer-0_10: several heap overflows (CVE-2009-0386, CVE-2009-0387,CVE-2009-0397) have been fixed. Remote attackers could exploit these to execute arbitrary code via QuickTime media files. last seen 2020-06-01 modified 2020-06-02 plugin id 40227 published 2009-07-21 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40227 title openSUSE Security Update : gstreamer-0_10-plugins-good (gstreamer-0_10-plugins-good-540) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2009-035.NASL description Security vulnerabilities have been discovered and corrected in gstreamer0.10-plugins-good, might allow remote attackers to execute arbitrary code via a malformed QuickTime media file (CVE-2009-0386, CVE-2009-0387, CVE-2009-0397). The updated packages have been patched to prevent this. last seen 2020-06-01 modified 2020-06-02 plugin id 37493 published 2009-04-23 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/37493 title Mandriva Linux Security Advisory : gstreamer0.10-plugins-good (MDVSA-2009:035) NASL family Fedora Local Security Checks NASL id FEDORA_2009-1213.NASL description - Mon Jan 26 2009 - Bastien Nocera <bnocera at redhat.com> - 0.10.13-1 - Update to 0.10.13 - Update libv4l patch - Wed Jan 14 2009 Warren Togami <wtogami at redhat.com> 0.10.11-4 - Bug #477877 Fix multilib conflict in -devel - Bug #478449 Fix ladspa on lib64 - Wed Jan 14 2009 Lennart Poettering <lpoetter at redhat.com> 0.10.11-3 - Bug #470000 Fix thread/memleak due to ref-loop - Tue Jan 13 2009 Bastien Nocera <bnocera at redhat.com> - 0.10.11-2 - Avoid pulsesink hang when PulseAudio disappears Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 36882 published 2009-04-23 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/36882 title Fedora 10 : gstreamer-plugins-good-0.10.13-1.fc10 (2009-1213)
Oval
| accepted | 2013-04-29T04:07:05.455-04:00 | ||||||||||||
| class | vulnerability | ||||||||||||
| contributors |
| ||||||||||||
| definition_extensions |
| ||||||||||||
| description | Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted Sync Sample (aka stss) atom data in a malformed QuickTime media .mov file, related to "mark keyframes." | ||||||||||||
| family | unix | ||||||||||||
| id | oval:org.mitre.oval:def:10611 | ||||||||||||
| status | accepted | ||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||
| title | Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted Sync Sample (aka stss) atom data in a malformed QuickTime media .mov file, related to "mark keyframes." | ||||||||||||
| version | 18 |
Redhat
| advisories |
| ||||
| rpms |
|
References
- http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53
- http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html
- http://secunia.com/advisories/33650
- http://secunia.com/advisories/33815
- http://secunia.com/advisories/34336
- http://secunia.com/advisories/35777
- http://security.gentoo.org/glsa/glsa-200907-11.xml
- http://trapkit.de/advisories/TKADV2009-003.txt
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:035
- http://www.openwall.com/lists/oss-security/2009/01/29/3
- http://www.redhat.com/support/errata/RHSA-2009-0271.html
- http://www.securityfocus.com/archive/1/500317/100/0/threaded
- http://www.securityfocus.com/bid/33405
- http://www.ubuntu.com/usn/USN-736-1
- http://www.vupen.com/english/advisories/2009/0225
- https://bugzilla.redhat.com/show_bug.cgi?id=481267
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10611