PT-2009-1021 · Gstreamer+2 · Gstreamer Good Plug-Ins+4
Tobias Klein
·
Publicado
2009-02-02
·
Atualizado
2018-10-11
·
CVE-2009-0397
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
GStreamer Good Plug-ins versions 0.10.9 through 0.10.11
GStreamer Plug-ins version 0.8.5
Description
The issue is related to a heap-based buffer overflow in the
qtdemux parse samples function, which might allow remote attackers to execute arbitrary code via crafted Time-to-sample (stts) atom data in a malformed QuickTime media .mov file. Additionally, there are multiple vulnerabilities in the gstreamer0.10-plugins-bad package that can lead to disruption of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.Recommendations
For GStreamer Good Plug-ins versions 0.10.9 through 0.10.11, update to a version outside of this range to mitigate the risk.
For GStreamer Plug-ins version 0.8.5, update to a newer version to resolve the issue.
As a temporary workaround, consider restricting access to malformed QuickTime media .mov files until a patch is available.
Avoid using the
qtdemux parse samples function in the affected GStreamer Good Plug-ins versions until the issue is resolved.Exploit
Correção
RCE
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Gstreamer Good Plug-Ins
Gstreamer Plug-Ins
Apple Quicktime
Red Hat
Gstreamer0.10-Plugins-Bad