Vulnerabilities > CVE-2014-3756 - Data Processing Errors vulnerability in Mumble

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
mumble
CWE-19
nessus
NVD
Published: 2014-11-16
Updated: 2014-11-17

Summary

The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.

Vulnerable Configurations

Part Description Count
Application
Mumble
11

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • XML Nested Payloads
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. By nesting XML data and causing this data to be continuously self-referential, an attacker can cause the XML parser to consume more resources while processing, causing excessive memory consumption and CPU utilization. An attacker's goal is to leverage parser failure to his or her advantage. In most cases this type of an attack will result in a denial of service due to an application becoming unstable, freezing, or crash. However it may be possible to cause a crash resulting in arbitrary code execution, leading to a jump from the data plane to the control plane [R.230.1].
  • XML Oversized Payloads
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. By supplying oversized payloads in input vectors that will be processed by the XML parser, an attacker can cause the XML parser to consume more resources while processing, causing excessive memory consumption and CPU utilization, and potentially cause execution of arbitrary code. An attacker's goal is to leverage parser failure to his or her advantage. In many cases this type of an attack will result in a denial of service due to an application becoming unstable, freezing, or crash. However it is possible to cause a crash resulting in arbitrary code execution, leading to a jump from the data plane to the control plane [R.231.1].
  • XML Client-Side Attack
    Client applications such as web browsers that process HTML data often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. These adverse effects may include the parser crashing, consuming too much of a resource, executing too slowly, executing code supplied by an attacker, allowing usage of unintended system functionality, etc. An attacker's goal is to leverage parser failure to his or her advantage. In some cases it may be possible to jump from the data plane to the control plane via bad data being passed to an XML parser. [R.484.1]
  • XML Parser Attack
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. These adverse effects may include the parser crashing, consuming too much of a resource, executing too slowly, executing code supplied by an attacker, allowing usage of unintended system functionality, etc. An attacker's goal is to leverage parser failure to his or her advantage. In some cases it may be possible to jump from the data plane to the control plane via bad data being passed to an XML parser. [R.99.1]

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2014-387.NASL
    descriptionmumble was updated to fix two security issues. - The Mumble client did not properly HTML-escape some external strings before using them in a rich-text (HTML) context (CVE-2014-3756). - SVG images with local file references could trigger client DoS (CVE-2014-3755).
    last seen2020-06-05
    modified2014-06-13
    plugin id75368
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75368
    titleopenSUSE Security Update : mumble (openSUSE-SU-2014:0706-1)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2014-387.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(75368);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2014-3755", "CVE-2014-3756");

  script_name(english:"openSUSE Security Update : mumble (openSUSE-SU-2014:0706-1)");
  script_summary(english:"Check for the openSUSE-2014-387 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"mumble was updated to fix two security issues.

  - The Mumble client did not properly HTML-escape some
    external strings before using them in a rich-text (HTML)
    context (CVE-2014-3756).

  - SVG images with local file references could trigger
    client DoS (CVE-2014-3755)."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=877969"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=877971"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2014-05/msg00068.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected mumble packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mumble");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mumble-32bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mumble-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mumble-debuginfo-32bit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mumble-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mumble-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mumble-server-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1");

  script_set_attribute(attribute:"patch_publication_date", value:"2014/05/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE12\.3|SUSE13\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.3 / 13.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE12.3", reference:"mumble-1.2.6-21.8.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"mumble-debuginfo-1.2.6-21.8.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"mumble-debugsource-1.2.6-21.8.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"mumble-server-1.2.6-21.8.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"mumble-server-debuginfo-1.2.6-21.8.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"mumble-32bit-1.2.6-21.8.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"mumble-debuginfo-32bit-1.2.6-21.8.1") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"mumble-1.2.6-2.12.2") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"mumble-debuginfo-1.2.6-2.12.2") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"mumble-debugsource-1.2.6-2.12.2") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"mumble-server-1.2.6-2.12.2") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"mumble-server-debuginfo-1.2.6-2.12.2") ) flag++;
if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"mumble-32bit-1.2.6-2.12.2") ) flag++;
if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"mumble-debuginfo-32bit-1.2.6-2.12.2") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mumble");
}
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201406-06.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201406-06 (Mumble: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mumble: A crafted length prefix value can trigger a heap-based buffer overflow or NULL pointer dereference in the opus_packet_get_samples_per_frame function (CVE-2014-0044) A crafted packet can trigger an error in the opus_decode_float function, leading to a heap-based buffer overflow (CVE-2014-0045) A crafted SVG referencing local files can lead to resource exhaustion or hangs (CVE-2014-3755) Mumble does not properly escape HTML in some external strings before displaying them (CVE-2014-3756) Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id74371
    published2014-06-07
    reporterThis script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74371
    titleGLSA-201406-06 : Mumble: Multiple vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2014-6472.NASL
    descriptionNew upstream release 1.2.6. This update fixes : - CVE-2014-3755 - CVE-2014-3756 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2014-05-28
    plugin id74201
    published2014-05-28
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74201
    titleFedora 20 : mumble-1.2.6-1.fc20 (2014-6472)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2014-6470.NASL
    descriptionNew upstream release 1.2.6. This update fixes : - CVE-2014-3755 - CVE-2014-3756 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2014-05-28
    plugin id74200
    published2014-05-28
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74200
    titleFedora 19 : mumble-1.2.6-1.fc19 (2014-6470)

References