-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 xine security announcement ========================== Announcement-ID: XSA-2004-5 Summary: A heap overflow has been found in the DVD subpicture decoder of xine-lib. This can be used for a remote heap overflow exploit, which can, on some systems, lead to or help in executing malicious code with the permissions of the user running a xine-lib based media application. Description: When a xine-lib based media application is playing content including DVD subpictures, the subtitle decoder converts the DVD subpictures, which are essentially run-length encoded bitmaps, into xine-lib's own internal subpicture format. The result of this conversion is written to a dynamically allocated memory block on the heap. This memory block can overrun with certain subpictures: DVD subpictures are stored in two fields. The first containing the odd numbered lines, the second containing the even numbered lines. Offsets in the subpicture header indicate the beginning of each field in the RLE data. When these two fields are now stored in an overlapping manor, so that the beginning of the second field reuses RLE data from the end of the first, the resulting xine overlay will use up more space than previously allocated, because the allocation did not take this possibility into account. Since DVD subpictures do not only occur on DVDs, but may also be used in standalone MPEG files, an attacker can craft a malicious MPEG file containing such a subpicture with overlapping fields. This can be used to overflow the heap buffer, which can, with certain implementations of heap management, lead to attacker chosen data written to the stack. By placing such a MPEG file on the internet and tricking users to view it using network streaming, this is remotely exploitable. Severity: This is very difficult to exploit, because multiple indirections are involved: Firstly, the DVD subpicture data is expanded to xine-lib's internal subpicture format before it is written to the heap. Secondly, the heap overlow needs to alter heap management information in a way so that a return adress on the stack is modified. Thirdly, this adress must lead to some malicious code to be executed, which needs to be injected somehow. Although the involved xine plugin is part of the standard xine installation, we consider this problem to be only moderately severe, because of the difficulty in exploiting it. Affected versions: All 0.5 releases starting with and including 0.5.2. All 0.9 releases. All 1-alpha releases. All 1-beta releases. All 1-rc releases up to and including 1-rc5. Unaffected versions: All releases older than 0.5.2. 1-rc6 or newer. Solution: The enclosed patch which has been applied to xine-lib CVS fixes the problem but should only be used by distributors who do not want to upgrade. Otherwise, we strongly advise everyone to upgrade to the 1-rc6 release of xine-lib. As a temporary workaround, you may delete the file "xineplug_decode_spu.so" from the xine-lib plugin directory, losing the ability to decode DVD subpictures with xine-lib. Patch: http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/libspudec/spu.c?r1=1.77&r2=1.78&diff_format=u For further information and in case of questions, please contact the xine team. Our website is http://xinehq.de/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFBPLy1jhx3hMVnyYsRAngbAJ0Vy0F9wde/qafkBiB58xI4hb+tfwCgi7Fn 5qKEG8iA7EG/f2Cm03YMtzU= =wto9 -----END PGP SIGNATURE-----
