full-disclosure - Need of some Information--MPlayer demux_open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 27 Jul 2009 16:51:57 +0530
From: jacki buddy <jacki.buddy@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Need of some Information--MPlayer demux_open_vqf
	TwinVQ File Handling Buffer Overflow

Hi All
I am in need of some Information for the below mentioned Vulnerability.

CVE-2008-5616
MPlayer demux_open_vqf TwinVQ File Handling Buffer Overflow
Description:
MPlayer contains a stack buffer overflow vulnerability while parsing
malformed TwinVQ media files, where TwinVQ (transform-domain weighted
interleaved vector quantization) is an audio compression technique
developed by Nippon Telegraph and Telephone Corporation (NTT). The
vulnerability may be exploited by the remote attacker to execute
arbitrary code in the context of MPlayer. The vulnerable function is
demux_open_vqf() and the vulnerable parameters are Chunk Size of COMM
chunk, and Tag Length of any tag within it. The vulnerable programs
are mplayer, gmplayer and mencoder on Linux-based systems.
Mplayer.exe, gmplayer.exe and mencoder.exe on Windows-based systems.
This issue affects MPlayer 1.0rc2, other versions may also be
affected.

Vulnerability Analysis
* TwinVQ (transform-domain weighted interleaved vector quantization)
is an audio compression technique developed by Nippon Telegraph and
Telephone Corporation (NTT).
* MPlayer contains a stack buffer overflow vulnerability while parsing
malformed TwinVQ media files.
* TWIN constant expression for TWINVQ is always followed by 8 digits
version number
* COMM is the Standard Sub-chunk will fall after 4 byte size relative
to TWIN pattern.
* Data_size from DSIZ subchunk unsigned value is having vulnerability.

* In the malicious packet i analyze, The sub-chunk size is around 8191
bytes ( 0x  00 00 1f ff).

But as per the file format all these sub-chunk fields are very small.
Even if all these sub-chunks
are present, I didn't see that is exceed not more than say around 300-400 bytes.

So can i conclude that If the sub-chunk size is more than the above
mentioned value, we can trigger an
alert.
Please help me out in the above mentioned issue

Thanks & Regards
Jacki

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/