Re: [xine-user] [remote] [control] xine-lib open_aiff_file overflows buffer

--Boundary-00=_aeKwBB15LpGTc5o
Content-Type: text/plain;
  charset="iso-8859-15"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

I am taking this discussion to xine-devel.

Hello,

> Ariel Berkman, a student in my Fall 2004 UNIX Security Holes course, has
> discovered a remotely exploitable security hole in xine-lib. I'm
> publishing this notice, but all the discovery credits should be assigned
> to Berkman.
[snip]
>
> Here's the bug: In demux_aiff.c, open_aiff_file() reads an
> input-specified amount of data into a 100-byte buffer[] array.

Thanks for reporting this to us. This has been fixed in CVS and the fix will 
be included in the next release. I attached the cvslog mail in case you want 
to review the fix. We will also publish this issue as a xine security 
advisory soon, giving you and Ariel Berkman the proper credit.

To the team: I think we will have to schedule a 1-rc8a release...

Michael

-- 
printk("HPFS: Grrrr... Kernel memory corrupted ... going on, but 
it'll crash very soon :-(\n");
	2.4.3 linux/fs/hpfs/super.c

--Boundary-00=_aeKwBB15LpGTc5o
Content-Type: message/rfc822;
  name="forwarded message"
Content-Transfer-Encoding: 7bit
Content-Description: Michael Roitzsch <[email protected]>: [xine-cvs] CVS: xine-lib/src/demuxers demux_aiff.c,1.39,1.40
Content-Disposition: inline

X-Envelope-From: <[email protected]>
X-Envelope-To: <[email protected]>
X-Delivery-Time: 1103144683
Received: from sc8-sf-spam2.sourceforge.net (sc8-sf-sshgate.sourceforge.net [66.35.250.220])
	by mailin.webmailer.de (8.13.1/8.13.1) with ESMTP id iBFL4gTn014903
	for <[email protected]>; Wed, 15 Dec 2004 22:04:43 +0100 (MET)
Received: from sc8-sf-list2-b.sourceforge.net ([10.3.1.8] helo=projects.sourceforge.net)
	by sc8-sf-spam2.sourceforge.net with esmtp (Exim 4.33)
	id 1CegJV-0002pz-2u; Wed, 15 Dec 2004 13:04:01 -0800
Received: from sc8-sf-mx2-b.sourceforge.net ([10.3.1.12] helo=sc8-sf-mx2.sourceforge.net)
	by sc8-sf-list2.sourceforge.net with esmtp (Exim 4.30)
	id 1CegIh-0000mN-CI
	for [email protected]; Wed, 15 Dec 2004 13:03:11 -0800
Received: from sc8-pr-cvs1-f.sourceforge.net ([10.4.1.7] helo=sc8-pr-cvs1.sourceforge.net)
	by sc8-sf-mx2.sourceforge.net with esmtp (TLSv1:AES256-SHA:256)
	(Exim 4.41)
	id 1CegIg-0007Bw-RJ
	for [email protected]; Wed, 15 Dec 2004 13:03:11 -0800
Received: from mroi by sc8-pr-cvs1.sourceforge.net with local (Exim 4.20)
	id 1CegIb-0008Ro-HD
	for [email protected]; Wed, 15 Dec 2004 13:03:05 -0800
To: [email protected]
Message-Id: <[email protected]>
From: Michael Roitzsch <[email protected]>
X-Spam-Score: -4.9 (----)
X-Spam-Report: Spam Filtering performed by sourceforge.net.
	See http://spamassassin.org/tag/ for more details.
	Report problems to http://sf.net/tracker/?func=add&group_id=1&atid=200001
	-4.9 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
	[score: 0.0000]
	0.0 AWL                    AWL: Auto-whitelist adjustment
Subject: [xine-cvs] CVS: xine-lib/src/demuxers demux_aiff.c,1.39,1.40
Sender: [email protected]
Errors-To: [email protected]
X-BeenThere: [email protected]
X-Mailman-Version: 2.0.9-sf.net
Precedence: bulk
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/xine-cvslog>,
	<mailto:[email protected]?subject=unsubscribe>
List-Id: our CVS list <xine-cvslog.lists.sourceforge.net>
List-Post: <mailto:[email protected]>
List-Help: <mailto:[email protected]?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/xine-cvslog>,
	<mailto:[email protected]?subject=subscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum=xine-cvslog>
X-Original-Date: Wed, 15 Dec 2004 13:03:05 -0800
Date: Wed, 15 Dec 2004 13:03:05 -0800
Content-Type: 

Update of /cvsroot/xine/xine-lib/src/demuxers
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv31474/demuxers

Modified Files:
	demux_aiff.c 
Log Message:
check for the chunk size the file tells us before blindly overflowing
the buffer; this was remotely exploitable, thanks to Ariel Berkman for
catching this and D. J. Bernstein for reporting it


Index: demux_aiff.c
===================================================================
RCS file: /cvsroot/xine/xine-lib/src/demuxers/demux_aiff.c,v
retrieving revision 1.39
retrieving revision 1.40
diff -u -r1.39 -r1.40
--- demux_aiff.c	13 Jun 2004 21:28:52 -0000	1.39
+++ demux_aiff.c	15 Dec 2004 21:03:02 -0000	1.40
@@ -120,6 +120,12 @@
     }
     chunk_type = BE_32(&preamble[0]);
     chunk_size = BE_32(&preamble[4]);
+    
+    if (chunk_size > sizeof(buffer) / sizeof(buffer[0])) {
+      /* the chunk is too large to fit in the buffer -> this cannot be an aiff chunk */
+      this->status = DEMUX_FINISHED;
+      return 0;
+    }
 
     if (chunk_type == COMM_TAG) {
       if (this->input->read(this->input, buffer, chunk_size) !=



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Xine-cvslog mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/xine-cvslog

--Boundary-00=_aeKwBB15LpGTc5o--


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/