Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 19 Nov 2016 11:59:32 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: gstreamer plugins

Hi,


On Fri, 18 Nov 2016 17:31:19 +0100
Marcus Meissner <meissner@...e.de> wrote:

> 1. Bufferoverflow in VMNC decoder in gstreamer plugins:
> 	https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html

I wanted to point out that while it's good the buffer overflow gets
fixed, that's by far not the major issue here.

This is a very problematic design decision with the functionality of
tracker/GNOME that exposes all files on a system to who knows how many
decoders of probably overall very low quality.
Almost certainly there are countless other vulnerabilities of similar
kind in all kinds of gstreamer codecs. (and I haven't checked, but I
assume tracker also exposes other files to other equally problematic
decoders)

I think this is kinda a symptom of two goals clashing: We have projects
like gstreamer that attempt to parse every file format ever seen in
their are - which of course has some value, especially in terms of
preserving digital culture. But on the other hand exposing this code to
untrusted inputs is a security disaster.

I'm wondering if there is any statement or reaction from either gnome
or fedora on this.

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno@...eck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.