Vulnerabilities > CVE-2014-4609 - Integer Overflow or Wraparound vulnerability in Libav
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10.2 allows remote attackers to execute arbitrary code via a crafted Literal Run.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Forced Integer Overflow This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
Nessus
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2977.NASL description Don A. Baley discovered an integer overflow in the lzo compression handler which could result in the execution of arbitrary code. last seen 2020-03-17 modified 2014-07-14 plugin id 76477 published 2014-07-14 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/76477 title Debian DSA-2977-1 : libav - security update code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-2977. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(76477); script_version("1.7"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2014-4609"); script_bugtraq_id(68217); script_xref(name:"DSA", value:"2977"); script_name(english:"Debian DSA-2977-1 : libav - security update"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Don A. Baley discovered an integer overflow in the lzo compression handler which could result in the execution of arbitrary code." ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/wheezy/libav" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2014/dsa-2977" ); script_set_attribute( attribute:"solution", value: "Upgrade the libav packages. For the stable distribution (wheezy), this problem has been fixed in version 6:0.8.13-1." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:ND"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libav"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/14"); script_set_attribute(attribute:"patch_publication_date", value:"2014/07/11"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/07/14"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"7.0", prefix:"ffmpeg", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"ffmpeg-dbg", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"ffmpeg-doc", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libav-dbg", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libav-doc", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libav-extra-dbg", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libav-tools", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavcodec-dev", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavcodec-extra-53", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavcodec53", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavdevice-dev", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavdevice-extra-53", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavdevice53", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavfilter-dev", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavfilter-extra-2", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavfilter2", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavformat-dev", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavformat-extra-53", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavformat53", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavutil-dev", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavutil-extra-51", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libavutil51", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libpostproc-dev", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libpostproc-extra-52", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libpostproc52", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libswscale-dev", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libswscale-extra-2", reference:"6:0.8.13-1")) flag++; if (deb_check(release:"7.0", prefix:"libswscale2", reference:"6:0.8.13-1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201502-08.NASL description The remote host is affected by the vulnerability described in GLSA-201502-08 (Libav: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Libav. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted media file in an application linked against Libav, possibly resulting in execution of arbitrary code with the privileges of the application or a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 81231 published 2015-02-09 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/81231 title GLSA-201502-08 : Libav: Multiple vulnerabilities code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201502-08. # # The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(81231); script_version("1.5"); script_cvs_date("Date: 2020/01/22"); script_cve_id("CVE-2011-3934", "CVE-2011-3935", "CVE-2011-3946", "CVE-2013-0848", "CVE-2013-0851", "CVE-2013-0852", "CVE-2013-0860", "CVE-2013-0868", "CVE-2013-3672", "CVE-2013-3674", "CVE-2014-4609"); script_bugtraq_id(51720, 57868, 60492, 60496, 63796, 63941, 68217); script_xref(name:"GLSA", value:"201502-08"); script_name(english:"GLSA-201502-08 : Libav: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201502-08 (Libav: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Libav. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted media file in an application linked against Libav, possibly resulting in execution of arbitrary code with the privileges of the application or a Denial of Service condition. Workaround : There is no known workaround at this time." ); # https://libav.org/news.html#0.8.9 script_set_attribute( attribute:"see_also", value:"https://libav.org/news/#0.8.9" ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201502-08" ); script_set_attribute( attribute:"solution", value: "All Libav users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=media-video/libav-9.17'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:libav"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2013/06/10"); script_set_attribute(attribute:"patch_publication_date", value:"2015/02/07"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/02/09"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"media-video/libav", unaffected:make_list("ge 9.17"), vulnerable:make_list("lt 9.17"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Libav"); }
NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2014-129.NASL description Multiple vulnerabilities has been discovered and corrected in ffmpeg : Multiple unspecified vulnerabilities in libavcodec/wmalosslessdec.c in FFmpeg before 0.11 have unknown impact and attack vectors related to (1) size of mclms arrays, (2) a get_bits(0) in decode_ac_filter, and (3) too many bits in decode_channel_residues(). (CVE-2012-2795). libavcodec/wmalosslessdec.c in FFmpeg before 2.1.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data (CVE-2014-2098). The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data (CVE-2014-2099). The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write (CVE-2014-2263). A use-after-free vulnerability in FFmpeg before 1.1.9 involving seek operations on video data could allow remote attackers to cause a denial of service (CVE-2012-5150). An integer overflow can occur when processing any variant of a literal run in the av_lzo1x_decode function (CVE-2014-4609, CVE-2014-4610). The updated packages have been upgraded to the 0.10.14 version which is not vulnerable to these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 76437 published 2014-07-10 reporter This script is Copyright (C) 2014-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/76437 title Mandriva Linux Security Advisory : ffmpeg (MDVSA-2014:129) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_65B14D39D01F419CB0B85DF60B929973.NASL description Please reference CVE/URL list for details last seen 2020-06-01 modified 2020-06-02 plugin id 83940 published 2015-06-02 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/83940 title FreeBSD : ffmpeg -- multiple vulnerabilities (65b14d39-d01f-419c-b0b8-5df60b929973)
The Hacker News
id | THN:9B30E750177FCE2138C2D9F3C42B178A |
last seen | 2018-01-27 |
modified | 2014-06-27 |
published | 2014-06-27 |
reporter | Mohit Kumar |
source | https://thehackernews.com/2014/06/20-years-old-vulnerability-in-lzo.html |
title | 20-Year Old Vulnerability in LZO Compression Algorithm Went to Planet Mars |
References
- http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html
- http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html
- http://www.openwall.com/lists/oss-security/2014/06/26/22
- http://www.openwall.com/lists/oss-security/2014/06/26/22
- https://libav.org/news/#2014-06-27
- https://libav.org/news/#2014-06-27