xine-lib rmff_dump_cont()远程堆溢出漏洞

BUGTRAQ ID: 27198 xine是一款免费的媒体播放器，支持多种格式。 xine处理畸形格式的数据时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户系统。 xine的input/libreal/rmff.c文件中的rmffdumpcont函数没有正确地处理SDP Title、Author、Copyright和Abstract属性，如果用户受骗连接到了恶意的RTSP服务器的话，就可能触发堆溢出，导致执行任意指令。以下是input/libreal/rmff.c中的漏洞代码： int rmffdumpheaderrmffheadert h, char buffer, int m...

CVE-2008-0225

Heap-based buffer overflow in the rmffdumpcont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmffdumpheader function and related to disregarding the max field. NOTE...

Heap overflow

Heap-based buffer overflow in the rmffdumpcont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmffdumpheader function and related to disregarding the max field. NOTE...

CVE-2008-0225

Heap-based buffer overflow in the rmffdumpcont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmffdumpheader function and related to disregarding the max field. NOTE...

CVE-2008-0225

CVE-2008-0225 is a vulnerability in xine-lib up to version 1.1.9 where a heap-based buffer overflow in rmff_dump_cont (rmff.c) can be triggered via the SDP Abstract attribute in an RTSP session. The root cause is the code path that disregards the max field in rmff_dump_header, leading to potentia...

CVE-2008-0225

Heap-based buffer overflow in the rmffdumpcont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmffdumpheader function and related to disregarding the max field. NOTE...

QuickTime Player 7.3.1.70 - RTSP Buffer Overflow (PoC)

QuickTime Player 7.3.1.70 - RTSP Buffer Overflow PoC Luigi Auriemma Application: Quicktime Player http://www.apple.com/quicktime Versions: = 7.3.1.70 Platforms: Windows and Mac Bug: buffer-overflow Exploitation: remote Date: 10 Jan 2008 Thanx to: swirl for the help during the re-testing of the bu...

QuickTime Player <= 7.3.1.70 (rtsp) Buffer Overflow Vulnerability

Exploit for unknown platform in category dos / poc ================================================================= Quicktime Player = 7.3.1.70 rtsp Buffer Overflow Vulnerability ================================================================= Luigi Auriemma Application: Quicktime Player...

Apple QuickTime RTSP Response message Reason-Phrase buffer overflow vulnerability

Overview Apple QuickTime contains a buffer overflow vulnerability that may allow a remote, unauthenticated attacker to cause a denial-of-service condition and possibly execute arbitrary code. Description Real Time Streaming Protocol RTSP is a protocol that is used by streaming media systems. Appl...

QuickTime Player 7.3.1.70 - 'RTSP' Buffer Overflow (PoC)

Luigi Auriemma Application: Quicktime Player http://www.apple.com/quicktime Versions: = 7.3.1.70 Platforms: Windows and Mac Bug: buffer-overflow Exploitation: remote Date: 10 Jan 2008 Thanx to: swirl for the help during the re-testing of the bug Author: Luigi Auriemma e-mail: [email protected]...

CVE-2007-6631

Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via 1 a reply that begins with a long version string, which triggers an overflow in handlertsppkt in rtsphandlers.c; long headers that trigger overflows in 2 sendpauserequest, 3...

CVE-2007-6630

The Urlinit function in utils/url.c in Netembryo 0.0.4, when used by LScube Feng, allows remote attackers to cause a denial of service NULL dereference and daemon crash via a malformed URI containing a "/:" sequence, as demonstrated by a "DESCRIBE /: RTSP/1.0" request...

CVE-2007-6628

LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service NULL dereference and daemon crash via 1 a malformed Transport header, which triggers misparsing in parsetransportheader in RTSPsetup.c, as demonstrated by a Transport header that contains only a...

Design/Logic Flaw

LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service NULL dereference and daemon crash via 1 a malformed Transport header, which triggers misparsing in parsetransportheader in RTSPsetup.c, as demonstrated by a Transport header that contains only a...

CVE-2007-6626

Multiple buffer overflows in the RTSPvalidresponsemsg function in RTSPstatemachine.c in LScube Feng 0.1.15 and earlier allow remote attackers to execute arbitrary code via 1 a long first line of a response, as demonstrated by a long VER line; or 2 a long second line of a response, as demonstrated...

CVE-2007-6627

CVE-2007-6627 affects LScube Feng

CVE-2007-6631

CVE-2007-6631 describes multiple buffer overflows in the LScube libnemesi 0.6.4-rc1 and earlier. The vulnerability allows remote code execution via crafted RTSP traffic, including: a reply beginning with a long version string that overflows handle_rtsp_pkt in rtsp_handlers.c; excessively long hea...

CVE-2007-6626

Multiple buffer overflows in the RTSPvalidresponsemsg function in RTSPstatemachine.c in LScube Feng 0.1.15 and earlier allow remote attackers to execute arbitrary code via 1 a long first line of a response, as demonstrated by a long VER line; or 2 a long second line of a response, as demonstrated...

CVE-2007-6628

CVE-2007-6628 affects LScube Feng 0.1.15 and earlier. The issue allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via two malformed headers: (1) Transport header triggering misparsing in RTSP_setup.c’s parse_transport_header (example: a header containing onl...

Feng多个远程溢出及拒绝服务漏洞

BUGTRAQ ID: 27049 Feng是意大利Politecnico di Torino大学所开发的开源RTSP/RTP流媒体服务器。 Feng的实现上存在多个缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户系统。 --------------------------------------------------- A RTSPvalidresponsemsg中缓冲区溢出（1） ---------------------------------------------------...