Search...

xine Real RTSP Stream Handling Overflow

2005-04-21T02:01:23

ID OSVDB:15885
Type osvdb
Reporter OSVDB
Modified 2005-04-21T02:01:23

Description

No description provided by the source

References:

Security Tracker: 1013783 Secunia Advisory ID:15210 Secunia Advisory ID:15129 Secunia Advisory ID:15065 Secunia Advisory ID:15284 Secunia Advisory ID:15412 Secunia Advisory ID:16017 Secunia Advisory ID:15571 Related OSVDB ID: 15884 Other Advisory URL: http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:094 Other Advisory URL: http://security.gentoo.org/glsa/glsa-200504-27.xml Other Advisory URL: http://xinehq.de/index.php/security/XSA-2004-8 Other Advisory URL: http://www.slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.451880 Other Advisory URL: http://www.ubuntulinux.org/support/documentation/usn/usn-123-1 Other Advisory URL: http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:115 Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-04/0337.html CVE-2005-1195

JSON Vulners Source

Initial Source

{"enchantments": {"score": {"value": 6.7, "vector": "NONE", "modified": "2017-04-28T13:20:11", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2005-1195"]}, {"type": "nessus", "idList": ["UBUNTU_USN-123-1.NASL", "GENTOO_GLSA-200504-19.NASL", "MANDRAKE_MDKSA-2005-115.NASL", "MANDRAKE_MDKSA-2005-094.NASL", "FREEBSD_PKG_91C606FCB5D011D9A7880001020EED82.NASL"]}, {"type": "gentoo", "idList": ["GLSA-200504-19"]}, {"type": "openvas", "idList": ["OPENVAS:54921", "OPENVAS:52545"]}, {"type": "osvdb", "idList": ["OSVDB:15884"]}, {"type": "ubuntu", "idList": ["USN-123-1"]}, {"type": "freebsd", "idList": ["91C606FC-B5D0-11D9-A788-0001020EED82"]}], "modified": "2017-04-28T13:20:11", "rev": 2}, "vulnersScore": 6.7}, "bulletinFamily": "software", "affectedSoftware": [], "references": [], "href": "https://vulners.com/osvdb/OSVDB:15885", "id": "OSVDB:15885", "title": "xine Real RTSP Stream Handling Overflow", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "lastseen": "2017-04-28T13:20:11", "edition": 1, "reporter": "OSVDB", "description": "# No description provided by the source\n\n## References:\nSecurity Tracker: 1013783\n[Secunia Advisory ID:15210](https://secuniaresearch.flexerasoftware.com/advisories/15210/)\n[Secunia Advisory ID:15129](https://secuniaresearch.flexerasoftware.com/advisories/15129/)\n[Secunia Advisory ID:15065](https://secuniaresearch.flexerasoftware.com/advisories/15065/)\n[Secunia Advisory ID:15284](https://secuniaresearch.flexerasoftware.com/advisories/15284/)\n[Secunia Advisory ID:15412](https://secuniaresearch.flexerasoftware.com/advisories/15412/)\n[Secunia Advisory ID:16017](https://secuniaresearch.flexerasoftware.com/advisories/16017/)\n[Secunia Advisory ID:15571](https://secuniaresearch.flexerasoftware.com/advisories/15571/)\n[Related OSVDB ID: 15884](https://vulners.com/osvdb/OSVDB:15884)\nOther Advisory URL: http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:094\nOther Advisory URL: http://security.gentoo.org/glsa/glsa-200504-27.xml\nOther Advisory URL: http://xinehq.de/index.php/security/XSA-2004-8\nOther Advisory URL: http://www.slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.451880\nOther Advisory URL: http://www.ubuntulinux.org/support/documentation/usn/usn-123-1\nOther Advisory URL: http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:115\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-04/0337.html\n[CVE-2005-1195](https://vulners.com/cve/CVE-2005-1195)\n", "modified": "2005-04-21T02:01:23", "viewCount": 0, "published": "2005-04-21T02:01:23", "cvelist": ["CVE-2005-1195"]}

{"cve": [{"lastseen": "2020-12-09T19:22:19", "description": "Multiple heap-based buffer overflows in the code used to handle (1) MMS over TCP (MMST) streams or (2) RealMedia RTSP streams in xine-lib before 1.0, and other products that use xine-lib such as MPlayer 1.0pre6 and earlier, allow remote malicious servers to execute arbitrary code.", "edition": 5, "cvss3": {}, "published": "2005-05-02T04:00:00", "title": "CVE-2005-1195", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2005-1195"], "modified": "2017-07-11T01:32:00", "cpe": ["cpe:/a:xine:xine-lib:1_beta11", "cpe:/a:xine:xine-lib:1_beta9", "cpe:/a:xine:xine-lib:1_beta3", "cpe:/a:xine:xine-lib:1_beta2", "cpe:/a:xine:xine-lib:1_beta6", "cpe:/a:xine:xine-lib:1_beta1", "cpe:/a:xine:xine-lib:1_rc3a", "cpe:/a:xine:xine-lib:1_beta8", "cpe:/a:xine:xine-lib:1_rc3b", "cpe:/a:mplayer:mplayer:1.0_pre6", "cpe:/a:xine:xine-lib:1_rc2", "cpe:/a:xine:xine-lib:1_rc3c", "cpe:/a:xine:xine-lib:1_beta5", "cpe:/a:xine:xine-lib:1_beta7", "cpe:/a:xine:xine-lib:1_beta4", "cpe:/a:xine:xine-lib:1_beta10"], "id": "CVE-2005-1195", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1195", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:xine:xine-lib:1_beta7:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_beta3:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_beta6:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_rc2:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_beta11:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_rc3c:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_beta2:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_beta9:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_beta8:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_rc3b:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_beta5:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_beta10:*:*:*:*:*:*:*", "cpe:2.3:a:mplayer:mplayer:1.0_pre6:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_beta4:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_rc3a:*:*:*:*:*:*:*", "cpe:2.3:a:xine:xine-lib:1_beta1:*:*:*:*:*:*:*"]}], "ubuntu": [{"lastseen": "2020-07-09T19:37:34", "bulletinFamily": "unix", "cvelist": ["CVE-2005-1195"], "description": "Two buffer overflows have been discovered in the MMS and Real RTSP \nstream handlers of the Xine library. By tricking a user to connect to \na malicious MMS or RTSP video/audio stream source with an application \nthat uses this library, an attacker could crash the client and \npossibly even execute arbitrary code with the privileges of the player \napplication.", "edition": 5, "modified": "2005-05-06T00:00:00", "published": "2005-05-06T00:00:00", "id": "USN-123-1", "href": "https://ubuntu.com/security/notices/USN-123-1", "title": "Xine library vulnerabilities", "type": "ubuntu", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:45", "bulletinFamily": "unix", "cvelist": ["CVE-2005-1195"], "edition": 1, "description": "### Background\n\nMPlayer is a media player capable of handling multiple multimedia file formats. \n\n### Description\n\nHeap overflows have been found in the code handling RealMedia RTSP and Microsoft Media Services streams over TCP (MMST). \n\n### Impact\n\nBy setting up a malicious server and enticing a user to use its streaming data, a remote attacker could possibly execute arbitrary code on the client computer with the permissions of the user running MPlayer. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll MPlayer users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=media-video/mplayer-1.0_pre6-r4\"", "modified": "2006-05-22T00:00:00", "published": "2005-04-20T00:00:00", "id": "GLSA-200504-19", "href": "https://security.gentoo.org/glsa/200504-19", "type": "gentoo", "title": "MPlayer: Two heap overflow vulnerabilities", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:11", "bulletinFamily": "software", "cvelist": ["CVE-2005-1195"], "edition": 1, "description": "# No description provided by the source\n\n## References:\nSecurity Tracker: 1013783\n[Secunia Advisory ID:15210](https://secuniaresearch.flexerasoftware.com/advisories/15210/)\n[Secunia Advisory ID:15065](https://secuniaresearch.flexerasoftware.com/advisories/15065/)\n[Secunia Advisory ID:15129](https://secuniaresearch.flexerasoftware.com/advisories/15129/)\n[Secunia Advisory ID:15284](https://secuniaresearch.flexerasoftware.com/advisories/15284/)\n[Secunia Advisory ID:15412](https://secuniaresearch.flexerasoftware.com/advisories/15412/)\n[Secunia Advisory ID:16017](https://secuniaresearch.flexerasoftware.com/advisories/16017/)\n[Secunia Advisory ID:15571](https://secuniaresearch.flexerasoftware.com/advisories/15571/)\n[Related OSVDB ID: 15885](https://vulners.com/osvdb/OSVDB:15885)\nOther Advisory URL: http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:094\nOther Advisory URL: http://xinehq.de/index.php/security/XSA-2004-8\nOther Advisory URL: http://security.gentoo.org/glsa/glsa-200504-27.xml\nOther Advisory URL: http://www.slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.451880\nOther Advisory URL: http://www.ubuntulinux.org/support/documentation/usn/usn-123-1\nOther Advisory URL: http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:115\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-04/0337.html\n[CVE-2005-1195](https://vulners.com/cve/CVE-2005-1195)\n", "modified": "2005-04-21T02:01:23", "published": "2005-04-21T02:01:23", "href": "https://vulners.com/osvdb/OSVDB:15884", "id": "OSVDB:15884", "title": "xine MMST Stream Handling Overflow", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2017-07-24T12:50:00", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-1195"], "description": "The remote host is missing updates announced in\nadvisory GLSA 200504-19.", "modified": "2017-07-07T00:00:00", "published": "2008-09-24T00:00:00", "id": "OPENVAS:54921", "href": "http://plugins.openvas.org/nasl.php?oid=54921", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200504-19 (MPlayer)", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Two vulnerabilities have been found in MPlayer which could lead to the\nremote execution of arbitrary code.\";\ntag_solution = \"All MPlayer users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=media-video/mplayer-1.0_pre6-r4'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200504-19\nhttp://bugs.gentoo.org/show_bug.cgi?id=89277\nhttp://www.mplayerhq.hu/homepage/design7/news.html#vuln10\nhttp://www.mplayerhq.hu/homepage/design7/news.html#vuln11\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200504-19.\";\n\n \n\nif(description)\n{\n script_id(54921);\n script_cve_id(\"CVE-2005-1195\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_name(\"Gentoo Security Advisory GLSA 200504-19 (MPlayer)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"media-video/mplayer\", unaffected: make_list(\"ge 1.0_pre6-r4\"), vulnerable: make_list(\"lt 1.0_pre6-r4\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-02T21:10:19", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-1195"], "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2016-09-26T00:00:00", "published": "2008-09-04T00:00:00", "id": "OPENVAS:52545", "href": "http://plugins.openvas.org/nasl.php?oid=52545", "type": "openvas", "title": "mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities", "sourceData": "#\n#VID 91c606fc-b5d0-11d9-a788-0001020eed82\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following packages are affected:\n mplayer\n mplayer-gtk\n mplayer-gtk2\n mplayer-esound\n mplayer-gtk-esound\n mplayer-gtk2-esound\n libxine\n\nCVE-2005-1195\nMultiple heap-based buffer overflows in the code used to handle (1)\nMMST streams or (2) RealMedia RTSP streams in MPlayer 1.0pre6 and\nearlier allow remote malicious servers to execute arbitrary code.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://www.mplayerhq.hu/homepage/design7/news.html#vuln10\nhttp://www.mplayerhq.hu/homepage/design7/news.html#vuln11\nhttp://xinehq.de/index.php/security/XSA-2004-8\nhttp://www.vuxml.org/freebsd/91c606fc-b5d0-11d9-a788-0001020eed82.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(52545);\n script_version(\"$Revision: 4144 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-26 07:28:56 +0200 (Mon, 26 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_cve_id(\"CVE-2005-1195\");\n script_bugtraq_id(13270,13271);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"mplayer\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.99.7\")<0) {\n txt += 'Package mplayer version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"mplayer-gtk\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.99.7\")<0) {\n txt += 'Package mplayer-gtk version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"mplayer-gtk2\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.99.7\")<0) {\n txt += 'Package mplayer-gtk2 version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"mplayer-esound\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.99.7\")<0) {\n txt += 'Package mplayer-esound version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"mplayer-gtk-esound\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.99.7\")<0) {\n txt += 'Package mplayer-gtk-esound version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"mplayer-gtk2-esound\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.99.7\")<0) {\n txt += 'Package mplayer-gtk2-esound version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"libxine\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.9.9\")>=0 && revcomp(a:bver, b:\"1.0.1\")<0) {\n txt += 'Package libxine version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "freebsd": [{"lastseen": "2019-05-29T18:34:59", "bulletinFamily": "unix", "cvelist": ["CVE-2005-1195"], "description": "\nA xine security announcement reports:\n\nBy a user receiving data from a malicious network\n\t streaming server, an attacker can overrun a heap buffer,\n\t which can, on some systems, lead to or help in executing\n\t attacker-chosen malicious code with the permissions of the\n\t user running a xine-lib based media application.\nBoth the MMS and Real RTSP streaming client code made\n\t some too-strong assumptions on the transferred\n\t data. Several critical bounds checks were missing,\n\t resulting in the possibility of heap overflows, should the\n\t remote server not adhere to these assumptions. In the MMS\n\t case, a remote server could present content with too many\n\t individual streams; in the RTSP case, a remote server's\n\t reply could have too many lines.\nAn attacker can set up a server delivering malicious data\n\t to the users. This can be used to overflow a heap buffer,\n\t which can, with certain implementations of heap\n\t management, lead to attacker chosen data written to the\n\t stack. This can cause attacker-chosen code being executed\n\t with the permissions of the user running the\n\t application. By tricking users to retrieve a stream, which\n\t can be as easy as providing a link on a website, this\n\t vulnerability can be exploited remotely.\n\n", "edition": 4, "modified": "2005-04-16T00:00:00", "published": "2005-04-16T00:00:00", "id": "91C606FC-B5D0-11D9-A788-0001020EED82", "href": "https://vuxml.freebsd.org/freebsd/91c606fc-b5d0-11d9-a788-0001020eed82.html", "title": "mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities", "type": "freebsd", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2021-01-07T10:51:56", "description": "The remote host is affected by the vulnerability described in GLSA-200504-19\n(MPlayer: Two heap overflow vulnerabilities)\n\n Heap overflows have been found in the code handling RealMedia RTSP and\n Microsoft Media Services streams over TCP (MMST).\n \nImpact :\n\n By setting up a malicious server and enticing a user to use its\n streaming data, a remote attacker could possibly execute arbitrary code\n on the client computer with the permissions of the user running\n MPlayer.\n \nWorkaround :\n\n There is no known workaround at this time.", "edition": 24, "published": "2005-04-21T00:00:00", "title": "GLSA-200504-19 : MPlayer: Two heap overflow vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-1195"], "modified": "2005-04-21T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:mplayer", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-200504-19.NASL", "href": "https://www.tenable.com/plugins/nessus/18102", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200504-19.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(18102);\n script_version(\"1.17\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2005-1195\");\n script_xref(name:\"GLSA\", value:\"200504-19\");\n\n script_name(english:\"GLSA-200504-19 : MPlayer: Two heap overflow vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200504-19\n(MPlayer: Two heap overflow vulnerabilities)\n\n Heap overflows have been found in the code handling RealMedia RTSP and\n Microsoft Media Services streams over TCP (MMST).\n \nImpact :\n\n By setting up a malicious server and enticing a user to use its\n streaming data, a remote attacker could possibly execute arbitrary code\n on the client computer with the permissions of the user running\n MPlayer.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n # http://www.mplayerhq.hu/homepage/design7/news.html#vuln10\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b32edb6d\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.mplayerhq.hu/homepage/design7/news.html#vuln11\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200504-19\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All MPlayer users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=media-video/mplayer-1.0_pre6-r4'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:mplayer\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/04/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/04/21\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/04/16\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"media-video/mplayer\", unaffected:make_list(\"ge 1.0_pre6-r4\"), vulnerable:make_list(\"lt 1.0_pre6-r4\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"MPlayer\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T11:51:27", "description": "Two heap overflows were discovered in mplayer's code handling the\nRealMedia RTSP and Microsoft Media Services streams over TCP (MMST).\nThese vulnerabilities could allow for a malicious server to execute\narbitrary code on the client computer with the permissions of the user\nrunning MPlayer.\n\nThe updated packages have been patched to correct this problem.", "edition": 25, "published": "2005-07-12T00:00:00", "title": "Mandrake Linux Security Advisory : mplayer (MDKSA-2005:115)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-1195"], "modified": "2005-07-12T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:lib64postproc0", "p-cpe:/a:mandriva:linux:libdha1.0", "cpe:/o:mandrakesoft:mandrake_linux:10.1", "p-cpe:/a:mandriva:linux:mplayer", "p-cpe:/a:mandriva:linux:mencoder", "p-cpe:/a:mandriva:linux:lib64postproc0-devel", "p-cpe:/a:mandriva:linux:mplayer-gui", "p-cpe:/a:mandriva:linux:libpostproc0-devel", "x-cpe:/o:mandrakesoft:mandrake_linux:le2005", "p-cpe:/a:mandriva:linux:libpostproc0"], "id": "MANDRAKE_MDKSA-2005-115.NASL", "href": "https://www.tenable.com/plugins/nessus/18677", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandrake Linux Security Advisory MDKSA-2005:115. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(18677);\n script_version(\"1.18\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2005-1195\");\n script_xref(name:\"MDKSA\", value:\"2005:115\");\n\n script_name(english:\"Mandrake Linux Security Advisory : mplayer (MDKSA-2005:115)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandrake Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Two heap overflows were discovered in mplayer's code handling the\nRealMedia RTSP and Microsoft Media Services streams over TCP (MMST).\nThese vulnerabilities could allow for a malicious server to execute\narbitrary code on the client computer with the permissions of the user\nrunning MPlayer.\n\nThe updated packages have been patched to correct this problem.\"\n );\n # http://www.mplayerhq.hu/homepage/design7/news.html#vuln10\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b32edb6d\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.mplayerhq.hu/homepage/design7/news.html#vuln11\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64postproc0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64postproc0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libdha1.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libpostproc0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libpostproc0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:mencoder\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:mplayer\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:mplayer-gui\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:10.1\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:mandrakesoft:mandrake_linux:le2005\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/07/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"libdha1.0-1.0-0.pre5.8.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"libpostproc0-1.0-0.pre5.8.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"libpostproc0-devel-1.0-0.pre5.8.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"mencoder-1.0-0.pre5.8.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"mplayer-1.0-0.pre5.8.1.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"mplayer-gui-1.0-0.pre5.8.1.101mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK10.2\", cpu:\"x86_64\", reference:\"lib64postproc0-1.0-0.pre6.8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"x86_64\", reference:\"lib64postproc0-devel-1.0-0.pre6.8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"i386\", reference:\"libdha1.0-1.0-0.pre6.8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"i386\", reference:\"libpostproc0-1.0-0.pre6.8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"i386\", reference:\"libpostproc0-devel-1.0-0.pre6.8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"mencoder-1.0-0.pre6.8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"mplayer-1.0-0.pre6.8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"mplayer-gui-1.0-0.pre6.8.1.102mdk\", yank:\"mdk\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T11:51:27", "description": "Two buffer overflow vulnerabilities were discovered in the MMS and\nReal RTSP stream handlers in the Xine libraries. If an attacker can\ntrick a user to connect to a malicious MMS or RTSP video/audio stream\nsource with any application using this library, they could crash the\nclient and possibly even execute arbitrary code with the privileges of\nthe user running the player program.\n\nThe updated packages have been patched to correct these problems.", "edition": 24, "published": "2005-06-02T00:00:00", "title": "Mandrake Linux Security Advisory : xine-lib (MDKSA-2005:094)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-1195"], "modified": "2005-06-02T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:xine-gnomevfs", "p-cpe:/a:mandriva:linux:libxine1", "p-cpe:/a:mandriva:linux:xine-smb", "cpe:/o:mandrakesoft:mandrake_linux:10.1", "p-cpe:/a:mandriva:linux:xine-plugins", "p-cpe:/a:mandriva:linux:lib64xine1-devel", "p-cpe:/a:mandriva:linux:xine-flac", "p-cpe:/a:mandriva:linux:xine-esd", "p-cpe:/a:mandriva:linux:xine-arts", "p-cpe:/a:mandriva:linux:xine-dxr3", "p-cpe:/a:mandriva:linux:libxine1-devel", "p-cpe:/a:mandriva:linux:lib64xine1", "x-cpe:/o:mandrakesoft:mandrake_linux:le2005", "p-cpe:/a:mandriva:linux:xine-polyp", "p-cpe:/a:mandriva:linux:xine-aa"], "id": "MANDRAKE_MDKSA-2005-094.NASL", "href": "https://www.tenable.com/plugins/nessus/18412", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandrake Linux Security Advisory MDKSA-2005:094. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(18412);\n script_version(\"1.18\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2005-1195\");\n script_xref(name:\"MDKSA\", value:\"2005:094\");\n\n script_name(english:\"Mandrake Linux Security Advisory : xine-lib (MDKSA-2005:094)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandrake Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Two buffer overflow vulnerabilities were discovered in the MMS and\nReal RTSP stream handlers in the Xine libraries. If an attacker can\ntrick a user to connect to a malicious MMS or RTSP video/audio stream\nsource with any application using this library, they could crash the\nclient and possibly even execute arbitrary code with the privileges of\nthe user running the player program.\n\nThe updated packages have been patched to correct these problems.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://xinehq.de/index.php/security/XSA-2004-8\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64xine1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64xine1-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libxine1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libxine1-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:xine-aa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:xine-arts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:xine-dxr3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:xine-esd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:xine-flac\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:xine-gnomevfs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:xine-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:xine-polyp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:xine-smb\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:10.1\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:mandrakesoft:mandrake_linux:le2005\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/05/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/06/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK10.1\", cpu:\"x86_64\", reference:\"lib64xine1-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"x86_64\", reference:\"lib64xine1-devel-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"libxine1-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"libxine1-devel-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"xine-aa-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"xine-arts-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"xine-dxr3-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"xine-esd-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"xine-flac-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"xine-gnomevfs-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", reference:\"xine-plugins-1-0.rc5.9.2.101mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK10.2\", cpu:\"x86_64\", reference:\"lib64xine1-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"x86_64\", reference:\"lib64xine1-devel-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"i386\", reference:\"libxine1-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"i386\", reference:\"libxine1-devel-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"xine-aa-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"xine-arts-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"xine-dxr3-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"xine-esd-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"xine-flac-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"xine-gnomevfs-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"xine-plugins-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"xine-polyp-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", reference:\"xine-smb-1.0-8.1.102mdk\", yank:\"mdk\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T10:47:21", "description": "A xine security announcement reports :\n\nBy a user receiving data from a malicious network streaming server, an\nattacker can overrun a heap buffer, which can, on some systems, lead\nto or help in executing attacker-chosen malicious code with the\npermissions of the user running a xine-lib based media application.\n\nBoth the MMS and Real RTSP streaming client code made some too-strong\nassumptions on the transferred data. Several critical bounds checks\nwere missing, resulting in the possibility of heap overflows, should\nthe remote server not adhere to these assumptions. In the MMS case, a\nremote server could present content with too many individual streams;\nin the RTSP case, a remote server's reply could have too many lines.\n\nAn attacker can set up a server delivering malicious data to the\nusers. This can be used to overflow a heap buffer, which can, with\ncertain implementations of heap management, lead to attacker chosen\ndata written to the stack. This can cause attacker-chosen code being\nexecuted with the permissions of the user running the application. By\ntricking users to retrieve a stream, which can be as easy as providing\na link on a website, this vulnerability can be exploited remotely.", "edition": 26, "published": "2005-07-13T00:00:00", "title": "FreeBSD : mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities (91c606fc-b5d0-11d9-a788-0001020eed82)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-1195"], "modified": "2005-07-13T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:mplayer", "p-cpe:/a:freebsd:freebsd:mplayer-gtk2-esound", "p-cpe:/a:freebsd:freebsd:mplayer-gtk2", "cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:libxine", "p-cpe:/a:freebsd:freebsd:mplayer-esound", "p-cpe:/a:freebsd:freebsd:mplayer-gtk", "p-cpe:/a:freebsd:freebsd:mplayer-gtk-esound"], "id": "FREEBSD_PKG_91C606FCB5D011D9A7880001020EED82.NASL", "href": "https://www.tenable.com/plugins/nessus/19031", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(19031);\n script_version(\"1.21\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2005-1195\");\n script_bugtraq_id(13270, 13271);\n\n script_name(english:\"FreeBSD : mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities (91c606fc-b5d0-11d9-a788-0001020eed82)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A xine security announcement reports :\n\nBy a user receiving data from a malicious network streaming server, an\nattacker can overrun a heap buffer, which can, on some systems, lead\nto or help in executing attacker-chosen malicious code with the\npermissions of the user running a xine-lib based media application.\n\nBoth the MMS and Real RTSP streaming client code made some too-strong\nassumptions on the transferred data. Several critical bounds checks\nwere missing, resulting in the possibility of heap overflows, should\nthe remote server not adhere to these assumptions. In the MMS case, a\nremote server could present content with too many individual streams;\nin the RTSP case, a remote server's reply could have too many lines.\n\nAn attacker can set up a server delivering malicious data to the\nusers. This can be used to overflow a heap buffer, which can, with\ncertain implementations of heap management, lead to attacker chosen\ndata written to the stack. This can cause attacker-chosen code being\nexecuted with the permissions of the user running the application. By\ntricking users to retrieve a stream, which can be as easy as providing\na link on a website, this vulnerability can be exploited remotely.\"\n );\n # http://www.mplayerhq.hu/homepage/design7/news.html#vuln10\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b32edb6d\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.mplayerhq.hu/homepage/design7/news.html#vuln11\"\n );\n # http://xinehq.de/index.php/security/XSA-2004-8\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://xinehq.de\"\n );\n # https://vuxml.freebsd.org/freebsd/91c606fc-b5d0-11d9-a788-0001020eed82.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e4fc2852\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:libxine\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mplayer\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mplayer-esound\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mplayer-gtk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mplayer-gtk-esound\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mplayer-gtk2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mplayer-gtk2-esound\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/04/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/04/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"mplayer<0.99.7\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mplayer-gtk<0.99.7\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mplayer-gtk2<0.99.7\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mplayer-esound<0.99.7\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mplayer-gtk-esound<0.99.7\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mplayer-gtk2-esound<0.99.7\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"libxine>=0.9.9<1.0.1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-20T15:21:57", "description": "Two buffer overflows have been discovered in the MMS and Real RTSP\nstream handlers of the Xine library. By tricking a user to connect to\na malicious MMS or RTSP video/audio stream source with an application\nthat uses this library, an attacker could crash the client and\npossibly even execute arbitrary code with the privileges of the player\napplication.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 24, "published": "2006-01-15T00:00:00", "title": "Ubuntu 4.10 / 5.04 : xine-lib vulnerabilities (USN-123-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-1195"], "modified": "2006-01-15T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libxine-dev", "p-cpe:/a:canonical:ubuntu_linux:libxine1", "cpe:/o:canonical:ubuntu_linux:5.04", "cpe:/o:canonical:ubuntu_linux:4.10"], "id": "UBUNTU_USN-123-1.NASL", "href": "https://www.tenable.com/plugins/nessus/20512", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-123-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(20512);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2005-1195\");\n script_xref(name:\"USN\", value:\"123-1\");\n\n script_name(english:\"Ubuntu 4.10 / 5.04 : xine-lib vulnerabilities (USN-123-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Two buffer overflows have been discovered in the MMS and Real RTSP\nstream handlers of the Xine library. By tricking a user to connect to\na malicious MMS or RTSP video/audio stream source with an application\nthat uses this library, an attacker could crash the client and\npossibly even execute arbitrary code with the privileges of the player\napplication.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libxine-dev and / or libxine1 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libxine-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libxine1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:4.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:5.04\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/05/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/01/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(4\\.10|5\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 4.10 / 5.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"4.10\", pkgname:\"libxine-dev\", pkgver:\"1-rc5-1ubuntu2.2\")) flag++;\nif (ubuntu_check(osver:\"4.10\", pkgname:\"libxine1\", pkgver:\"1-rc5-1ubuntu2.2\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"libxine-dev\", pkgver:\"1.0-1ubuntu3.1\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"libxine1\", pkgver:\"1.0-1ubuntu3.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxine-dev / libxine1\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}