xine security announcement XSA-2004-1

--Boundary-03=_pQofAWDfGhrP33t
Content-Type: multipart/mixed;
  boundary="Boundary-01=_oQofAyHui1o5jtS"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--Boundary-01=_oQofAyHui1o5jtS
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

xine security announcement
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

Announcement-ID: XSA-2004-1

Summary:
By opening a malicious MRL in any xine-lib based media player, an attacker =
can=20
write arbitrary content to an arbitrary file, only restricted by the=20
permissions of the user running the application.

Description:
MRLs (media resource locator) are a subset of URIs used by the xine-lib=20
library to describe the location of the content to play. MRLs also offer th=
e=20
feature of providing xine configuration options, which will be activated=20
right before the addressed content is played. But some of xine's=20
configuration options specify files that will be written to during playback=
=2E=20
One example of such an option is "audio.sun_audio_device", which specifies=
=20
the audio device on SUN machines. The decoded PCM samples of the audio stre=
am=20
will be written to this file. By having a user open a MRL like=20
"http://myserver/mybashrc#audio.sun_audio_device:.bashrc" in xine, which=20
changes the value of the "audio.sun_audio_device" option and plays a=20
specially crafted audio stream, an attacker could fill any file the user ha=
s=20
access to with arbitrary content. Other configuration options that allow su=
ch=20
an attack exist (we also found "dxr3.devicename"), so the vulnerability is=
=20
not limited to SUN machines.

Severity:
Expoits have not been seen in the public and not all xine setups use the=20
vulnerable configuration options. But at least xine users on SUN machines a=
nd=20
users of a DXR3 or Hollywood+ MPEG decoder card are vulnerable. Other such=
=20
problematic configuration options might have slipped through the review or=
=20
might be provided by xine plugins outside the main xine distribution, leavi=
ng=20
other users vulnerable as well. Given the wide range of possible harm, we=20
consider this problem to be highly critical.

Affected versions:
All 1-alpha releases.
All 1-beta releases.
All 1-rc releases up to and including 1-rc3a.

Unaffected versions:
All 0.9 releases or older.
1-rc3b or newer.

Solution:
Changes to xine configuration options via MRL are now disabled by default.
The attached patch to xine-lib fixes the problem but should only be used by=
=20
distributors who do not want to upgrade. Otherwise, we strongly advise=20
everyone to upgrade to the 1-rc3c release of xine-lib.

=46or further information and in case of questions, please contact the xine=
=20
team. Our website is http://xinehq.de/

Michael Roitzsch

--Boundary-01=_oQofAyHui1o5jtS
Content-Type: text/x-diff;
  charset="us-ascii";
  name="xine-lib-implicit-config.patch"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
	filename="xine-lib-implicit-config.patch"

=2D-- src/xine-engine/configfile.c	3 Mar 2004 20:09:16 -0000	1.62
+++ src/xine-engine/configfile.c	16 Mar 2004 20:50:08 -0000	1.63
@@ -969,6 +969,15 @@
   int          handled =3D 0;
=20
   lprintf ("change_opt '%s'\n", opt);
+ =20
+  if ((entry =3D config->lookup_entry(config, "misc.implicit_config")) &&
+      entry->type =3D=3D CONFIG_TYPE_BOOL) {
+    if (!entry->num_value)
+      /* changing config entries implicitly is denied */
+      return -1;
+  } else
+    /* someone messed with the config entry */
+    return -1;
=20
   if(config && opt) {
     char *key, *value;
=2D-- src/xine-engine/xine.c	3 Mar 2004 20:09:18 -0000	1.284
+++ src/xine-engine/xine.c	16 Mar 2004 20:50:09 -0000	1.285
@@ -1429,6 +1429,21 @@
       _("Path for saving streams"),
       _("Streams will be saved only into this directory"),
       XINE_CONFIG_SECURITY, __config_save_cb, this);
+ =20
+  /*
+   * implicit configuration changes
+   */
+  this->config->register_bool(this->config,
+      "misc.implicit_config", 0,
+      _("allow implicit changes to the configuration (e.g. by MRL)"),
+      _("If enabled, you allow xine to change your configuration without "
+	"explicit actions from your side. For example configuration changes "
+	"demanded by MRLs or embedded into playlist will be executed.\n"
+	"This setting is security critcal, because xine can receive MRLs or "
+	"playlists from untrusted remote sources. If you allow them to "
+	"arbitrarily change your configuration, you might end with a totally "
+	"messed up xine."),
+      XINE_CONFIG_SECURITY, NULL, this);
=20
   /*
    * keep track of all opened streams

--Boundary-01=_oQofAyHui1o5jtS--

--Boundary-03=_pQofAWDfGhrP33t
Content-Type: application/pgp-signature
Content-Description: signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQBAfoQpjhx3hMVnyYsRAqDOAJsHge4+JdrVVc9nq2shKItkVXafHwCfeu0i
ak1dinK1JuXt0cxfZfEqXdM=
=2wR8
-----END PGP SIGNATURE-----

--Boundary-03=_pQofAWDfGhrP33t--


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click