A boundary error condition in xine-lib versions 1-rc5 and 1-rc7 allows for arbitrary code execution.
16d1652200dbbf84c39bd07bfd776f45e532758e649d978d1e7bc23cbbbd270f
From djb@cr.yp.to Wed Dec 15 14:21:26 2004
Date: 15 Dec 2004 08:19:21 -0000
From: D. J. Bernstein <djb@cr.yp.to>
To: securesoftware@list.cr.yp.to, xine-user@lists.sourceforge.net
Subject: [remote] [control] xine-lib open_aiff_file overflows buffer
Ariel Berkman, a student in my Fall 2004 UNIX Security Holes course, has
discovered a remotely exploitable security hole in xine-lib. I'm
publishing this notice, but all the discovery credits should be assigned
to Berkman.
You are at risk if you take a file from the web (or email or any other
source that could be controlled by an attacker) and feed that file
through xine or any other xine-lib frontend. Whoever provides that file
then has complete control over your account: he can read and modify your
files, watch the programs you're running, etc.
Proof of concept: On an x86 computer running FreeBSD 4.10, as root, type
cd /usr/ports/multimedia/xine
make install
to download and compile the xine-lib library, version 1-rc5, and the
xine program. (Version 1-rc5 has other problems but is the latest ports
version. Version 1-rc7 fixes several bugs but does not fix the bug used
here.) Then save the file 20.avi attached to this message, and type
xine 20.avi
with the unauthorized result that a file named EXPLOITED is created in
the current directory. (I tested this with a 577-byte environment, as
reported by printenv | wc -c; beware that 20.avi is sensitive to the
environment size.)
Here's the bug: In demux_aiff.c, open_aiff_file() reads an
input-specified amount of data into a 100-byte buffer[] array.
---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
[ Part 2, Video/X-MSVIDEO 1.3KB. ]
[ Unable to print this part. ]