Security Advisories (MDKSA-2005:180): xine-lib

[aru]

Mandriva Security Advisories MDKSA-2005:180 : xine-lib

 

Updated xine-lib packages fixes cddb vulnerability

October 11th, 2005

 

When playing an Audio CD, a xine-lib based media application contacts a CDDB server to retrieve metadata like the title and artist's name.During processing of this data, a response from the server, which islocated in memory on the stack, is passed to the fprintf() functionas a format string. An attacker can set up a malicious CDDB serverand trick the client into using this server instead of the pre- configured one. Alternatively, any user and therefore the attacker can modify entries in the official CDDB server. Using this format string vulnerability, attacker-chosen data can be written to an attacker-chosen memory location.This allows the attacker to alter the control flow and to execute malicious code with the permissions of the user running the application.

 

This problem was reported by Ulf Harnhammar from the Debian SecurityAudit Project.

 

The updated packages have been patched to correct this problem.

 

 

The released versions of Mandriva GNU/Linux affected are:

• 10.1
  
• CS3.0
  
• 10.2
  
• 2006.0
  

Full information about this advisory, including the updated packages, is available at:

www.mandriva.com/security/advisories?name=MDKSA-2005:180

 

Other references:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2967

http://xinehq.de/index.php/security/XSA-2005-1

 

Posted automatically by aru (mdksec2mub v: mdksec2mub,v 0.14 2005/05/15 18:06:11 aru Exp aru $)