Vulnerabilities > CVE-2017-5846 - Out-of-bounds Read vulnerability in Gstreamer Project Gstreamer
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Overread Buffers An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
Nessus
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-3821.NASL description Hanno Boeck discovered multiple vulnerabilities in the GStreamer media framework and its codecs and demuxers, which may result in denial of service or the execution of arbitrary code if a malformed media file is opened. last seen 2020-06-01 modified 2020-06-02 plugin id 99007 published 2017-03-28 reporter This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/99007 title Debian DSA-3821-1 : gst-plugins-ugly1.0 - security update code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-3821. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(99007); script_version("3.5"); script_cvs_date("Date: 2018/11/10 11:49:38"); script_cve_id("CVE-2017-5846", "CVE-2017-5847"); script_xref(name:"DSA", value:"3821"); script_name(english:"Debian DSA-3821-1 : gst-plugins-ugly1.0 - security update"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Hanno Boeck discovered multiple vulnerabilities in the GStreamer media framework and its codecs and demuxers, which may result in denial of service or the execution of arbitrary code if a malformed media file is opened." ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/jessie/gst-plugins-ugly1.0" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2017/dsa-3821" ); script_set_attribute( attribute:"solution", value: "Upgrade the gst-plugins-ugly1.0 packages. For the stable distribution (jessie), these problems have been fixed in version 1.4.4-2+deb8u1. For the upcoming stable distribution (stretch), these problems have been fixed in version 1.10.4-1." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gst-plugins-ugly1.0"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0"); script_set_attribute(attribute:"patch_publication_date", value:"2017/03/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/28"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"8.0", prefix:"gstreamer1.0-plugins-ugly", reference:"1.4.4-2+deb8u1")) flag++; if (deb_check(release:"8.0", prefix:"gstreamer1.0-plugins-ugly-dbg", reference:"1.4.4-2+deb8u1")) flag++; if (deb_check(release:"8.0", prefix:"gstreamer1.0-plugins-ugly-doc", reference:"1.4.4-2+deb8u1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201705-10.NASL description The remote host is affected by the vulnerability described in GLSA-201705-10 (GStreamer plug-ins: User-assisted execution of arbitrary code) Multiple vulnerabilities have been discovered in various GStreamer plug-ins. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user or automated system using a GStreamer plug-in to process a specially crafted file, resulting in the execution of arbitrary code or a Denial of Service. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 100263 published 2017-05-18 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/100263 title GLSA-201705-10 : GStreamer plug-ins: User-assisted execution of arbitrary code NASL family Debian Local Security Checks NASL id DEBIAN_DLA-829.NASL description Two memory management issues were found in the asfdemux element of the GStreamer last seen 2020-03-17 modified 2017-02-21 plugin id 97234 published 2017-02-21 reporter This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/97234 title Debian DLA-829-1 : gst-plugins-ugly0.10 security update NASL family Debian Local Security Checks NASL id DEBIAN_DLA-2226.NASL description Two memory management issues were found in the asfdemux element of the GStreamer last seen 2020-06-06 modified 2020-06-01 plugin id 136982 published 2020-06-01 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/136982 title Debian DLA-2226-1 : gst-plugins-ugly0.10 security update
References
- http://www.debian.org/security/2017/dsa-3821
- http://www.openwall.com/lists/oss-security/2017/02/01/7
- http://www.openwall.com/lists/oss-security/2017/02/02/9
- http://www.securityfocus.com/bid/96001
- https://bugzilla.gnome.org/show_bug.cgi?id=777937
- https://gstreamer.freedesktop.org/releases/1.10/#1.10.3
- https://lists.debian.org/debian-lts-announce/2020/05/msg00030.html
- https://security.gentoo.org/glsa/201705-10