GStreamer 1.0 ID3v2 Tag MP3 File memory corruption

Summaryinfo

A vulnerability was found in GStreamer 1.0. It has been rated as critical. This issue affects some unknown processing of the component ID3v2 Tag Handler. This manipulation as part of MP3 File causes memory corruption. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is recommended to apply the suggested workaround.

Detailsinfo

A vulnerability classified as critical was found in GStreamer 1.0 (Multimedia Processing Software). Affected by this vulnerability is an unknown function of the component ID3v2 Tag Handler. The manipulation as part of a MP3 File leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was disclosed 12/08/2016 by Joshua as Gstreamer ID3v2 v1.0 - Out of Bounds Read as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but a public exploit is available. The advisory points out:

The Gstreamer ID3v2 implementation uses arbitrarily supplied data to generate buffers for the ID3v2 object and frames. By providing a maliciously crafted file with a null length in the ID3v2 header and an arbitrarily set length in the succeeding frame it is possible to generate an out of bounds read. An attacker may leverage this vulnerability to cause at minimum a denial of service attack.

A public exploit has been developed by Joshua and been published immediately after the advisory. It is possible to download the exploit at seclists.org. It is declared as proof-of-concept.

The best possible mitigation is suggested to be Workaround. The mailinglist post contains the following remark:

This vulnerability previously affects GNU/Linux-based Firefox versions 43 and below. Since Firefox is no longer built against Gstreamer the vulnerability is no longer relevant.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Multimedia Processing Software

Name

• GStreamer

Version

• 1.0

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion