bugtraq - [USN-309-1] libmms vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060705222934.GB23928@box79162.elkhouse.de>
Date: Thu, 6 Jul 2006 00:29:34 +0200
From: Martin Pitt <martin.pitt@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-309-1] libmms vulnerability

=========================================================== 
Ubuntu Security Notice USN-309-1              July 05, 2006
libmms vulnerability
CVE-2006-2200
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 5.10:
  libmms0                        0.1-0ubuntu1.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Several buffer overflows were found in libmms. By tricking a user into
opening a specially crafted remote multimedia stream with an
application using libmms, a remote attacker could overwrite an
arbitrary memory portion with zeros, thereby crashing the program.

In Ubuntu 5.10, this affects the GStreamer MMS plugin
(gstreamer0.8-mms). Other Ubuntu releases do not support this library.


Updated packages for Ubuntu 5.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms_0.1-0ubuntu1.1.diff.gz
      Size/MD5:     4933 76da674c4ce46f604acb09b473f72f1d
    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms_0.1-0ubuntu1.1.dsc
      Size/MD5:      607 3f7b2613ed4bda8a5d943141aa85d2d5
    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms_0.1.orig.tar.gz
      Size/MD5:   317089 ebd88537af9875265e41ee65603ecd1a

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms-dev_0.1-0ubuntu1.1_amd64.deb
      Size/MD5:    19656 5f4757ce0808238ce09df147b0a16251
    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms0_0.1-0ubuntu1.1_amd64.deb
      Size/MD5:    16042 bd2e57f384bad19a121b3d93c6ff7ec8

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms-dev_0.1-0ubuntu1.1_i386.deb
      Size/MD5:    18078 30ea92c953e77a62cea90060c5ffe195
    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms0_0.1-0ubuntu1.1_i386.deb
      Size/MD5:    14840 645668e9bf1b15cd3e7993bc8e66c6bd

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms-dev_0.1-0ubuntu1.1_powerpc.deb
      Size/MD5:    20206 ee2b12725fcaaaae1f2eb94a4fbf6e10
    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms0_0.1-0ubuntu1.1_powerpc.deb
      Size/MD5:    17700 013e1564d0aa094eddf28ae0723e264b

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms-dev_0.1-0ubuntu1.1_sparc.deb
      Size/MD5:    19894 b0e5d23a750dad2a0e2fa528e4ba9e02
    http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms0_0.1-0ubuntu1.1_sparc.deb
      Size/MD5:    16176 3246a55286c83b1ff2b3a6fc47ee4241

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/