MPlayer 1.0 Pre5 real.c real_setup_and_get_header heap-based overflow

Summaryinfo

A vulnerability classified as critical was found in MPlayer 1.0 Pre5. This affects the function real_setup_and_get_header of the file real.c. Such manipulation leads to heap-based overflow. This vulnerability is listed as CVE-2004-1311. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in MPlayer 1.0 Pre5 (Multimedia Player Software) and classified as very critical. Affected by this issue is the function real_setup_and_get_header of the file real.c. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

Integer overflow in the real_setup_and_get_header function in real.c for Unix MPlayer 1.0pre5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a Real RTSP streaming media file with a -1 content-length field, which leads to a heap-based buffer overflow.

The weakness was presented 01/10/2005 (Website). The advisory is shared for download at idefense.com. This vulnerability is handled as CVE-2004-1311 since 12/21/2004. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/05/2018).

The vulnerability scanner Nessus provides a plugin with the ID 16038 (Mandrake Linux Security Advisory : mplayer (MDKSA-2004:157)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Mandriva Local Security Checks and running in the context l.

Upgrading eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at X-Force (18525) and Tenable (16038). See VDB-15380, VDB-23827, VDB-23826 and VDB-23806 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Multimedia Player Software

Name

• MPlayer

Version

• 1.0 Pre5

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion