oss-security - Re: xine-lib and ocert-2008-008

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 3 Dec 2008 20:03:07 +0100
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com, coley@...re.org
Cc: redpig@...rt.org
Subject: Re: xine-lib and ocert-2008-008

Hi,
* Steven M. Christey <coley@...us.mitre.org> [2008-11-26 09:27]:
[...] 
> ======================================================
> Name: CVE-2008-5248
> Status: Candidate
> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5248
> Reference: CONFIRM:http://sourceforge.net/project/shownotes.php?release_id=619869
> 
> xine-lib before 1.1.15 allows remote attackers to cause a denial of
> service (crash) via "MP3 files with metadata consisting only of
> separators."

http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset;node=60ab5d2bdd82

This is the corresponding upstream patch.
139   i = len - 1;
140
141   while ((i >= 0) && ((unsigned char)str[i] <= 32)) {
142     str[i] = 0;
143     i--;
144   }

If len is size_t this is the problematic code if i len is 0 this will result in
a 0 bytes written all over the memory because of integer promotion.

Cheers
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.