Vulnerabilities > CVE-2014-4609 - Integer Overflow or Wraparound vulnerability in Libav

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
libav
CWE-190
nessus

Summary

Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10.2 allows remote attackers to execute arbitrary code via a crafted Literal Run.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2977.NASL
    descriptionDon A. Baley discovered an integer overflow in the lzo compression handler which could result in the execution of arbitrary code.
    last seen2020-03-17
    modified2014-07-14
    plugin id76477
    published2014-07-14
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/76477
    titleDebian DSA-2977-1 : libav - security update
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-2977. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(76477);
      script_version("1.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2014-4609");
      script_bugtraq_id(68217);
      script_xref(name:"DSA", value:"2977");
    
      script_name(english:"Debian DSA-2977-1 : libav - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Don A. Baley discovered an integer overflow in the lzo compression
    handler which could result in the execution of arbitrary code."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/wheezy/libav"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2014/dsa-2977"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the libav packages.
    
    For the stable distribution (wheezy), this problem has been fixed in
    version 6:0.8.13-1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:ND");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libav");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2014/07/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/07/14");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"7.0", prefix:"ffmpeg", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"ffmpeg-dbg", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"ffmpeg-doc", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libav-dbg", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libav-doc", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libav-extra-dbg", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libav-tools", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavcodec-dev", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavcodec-extra-53", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavcodec53", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavdevice-dev", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavdevice-extra-53", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavdevice53", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavfilter-dev", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavfilter-extra-2", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavfilter2", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavformat-dev", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavformat-extra-53", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavformat53", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavutil-dev", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavutil-extra-51", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libavutil51", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libpostproc-dev", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libpostproc-extra-52", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libpostproc52", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libswscale-dev", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libswscale-extra-2", reference:"6:0.8.13-1")) flag++;
    if (deb_check(release:"7.0", prefix:"libswscale2", reference:"6:0.8.13-1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201502-08.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201502-08 (Libav: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Libav. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted media file in an application linked against Libav, possibly resulting in execution of arbitrary code with the privileges of the application or a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id81231
    published2015-02-09
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81231
    titleGLSA-201502-08 : Libav: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201502-08.
    #
    # The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(81231);
      script_version("1.5");
      script_cvs_date("Date: 2020/01/22");
    
      script_cve_id("CVE-2011-3934", "CVE-2011-3935", "CVE-2011-3946", "CVE-2013-0848", "CVE-2013-0851", "CVE-2013-0852", "CVE-2013-0860", "CVE-2013-0868", "CVE-2013-3672", "CVE-2013-3674", "CVE-2014-4609");
      script_bugtraq_id(51720, 57868, 60492, 60496, 63796, 63941, 68217);
      script_xref(name:"GLSA", value:"201502-08");
    
      script_name(english:"GLSA-201502-08 : Libav: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201502-08
    (Libav: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in Libav. Please review
          the CVE identifiers referenced below for details.
      
    Impact :
    
        A remote attacker could entice a user to open a specially crafted media
          file in an application linked against Libav, possibly resulting in
          execution of arbitrary code with the privileges of the application or a
          Denial of Service condition.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      # https://libav.org/news.html#0.8.9
      script_set_attribute(
        attribute:"see_also",
        value:"https://libav.org/news/#0.8.9"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201502-08"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Libav users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=media-video/libav-9.17'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:libav");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2013/06/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/02/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/02/09");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"media-video/libav", unaffected:make_list("ge 9.17"), vulnerable:make_list("lt 9.17"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Libav");
    }
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2014-129.NASL
    descriptionMultiple vulnerabilities has been discovered and corrected in ffmpeg : Multiple unspecified vulnerabilities in libavcodec/wmalosslessdec.c in FFmpeg before 0.11 have unknown impact and attack vectors related to (1) size of mclms arrays, (2) a get_bits(0) in decode_ac_filter, and (3) too many bits in decode_channel_residues(). (CVE-2012-2795). libavcodec/wmalosslessdec.c in FFmpeg before 2.1.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data (CVE-2014-2098). The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data (CVE-2014-2099). The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write (CVE-2014-2263). A use-after-free vulnerability in FFmpeg before 1.1.9 involving seek operations on video data could allow remote attackers to cause a denial of service (CVE-2012-5150). An integer overflow can occur when processing any variant of a literal run in the av_lzo1x_decode function (CVE-2014-4609, CVE-2014-4610). The updated packages have been upgraded to the 0.10.14 version which is not vulnerable to these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id76437
    published2014-07-10
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/76437
    titleMandriva Linux Security Advisory : ffmpeg (MDVSA-2014:129)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_65B14D39D01F419CB0B85DF60B929973.NASL
    descriptionPlease reference CVE/URL list for details
    last seen2020-06-01
    modified2020-06-02
    plugin id83940
    published2015-06-02
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83940
    titleFreeBSD : ffmpeg -- multiple vulnerabilities (65b14d39-d01f-419c-b0b8-5df60b929973)

The Hacker News

idTHN:9B30E750177FCE2138C2D9F3C42B178A
last seen2018-01-27
modified2014-06-27
published2014-06-27
reporterMohit Kumar
sourcehttps://thehackernews.com/2014/06/20-years-old-vulnerability-in-lzo.html
title20-Year Old Vulnerability in LZO Compression Algorithm Went to Planet Mars