untrusted code execution using NES music file play using gstreamer NES CPU emulation CESA-2016-0001

[vishnunaini]

First, I am NOT the person who found the bug. It is a zero day vulnerability(i.e already public).

A vulnerability and a separate logic error exist in the gstreamer 0.10.x player for NSF music files. Combined, they allow for very reliable exploitation and the bypass of 64-bit ASLR, DEP, etc. The reliability is provided by the presence of a turing complete “scripting” inside a music player. NSF files are music files from the Nintendo Entertainment System.

The person who found it detailed it here
https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-compromising-linux-desktop.html

Precise and trusty are effected. xenial can be effected if 0.10 is manually installed.

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[vishnunaini (visred)]

I am not going to touch the code myself but I will post a debdiff if upstream debian updates it in wheezy.

But I still request the security team to look at it because this problem exists in a default install and also could compromise the system by just opening nautilus.

[Launchpad Janitor (janitor)]

This bug was fixed in the package gst-plugins-bad0.10 - 0.10.22.3-2ubuntu2.4

---------------
gst-plugins-bad0.10 (0.10.22.3-2ubuntu2.4) precise-security; urgency=medium

  * SECURITY UPDATE: code execution via NSF music file (LP: #1641700)
    - debian/gstreamer-plugins-bad.install: remove libgstnsf.so
    - No CVE number

 -- Marc Deslauriers <email address hidden> Mon, 14 Nov 2016 16:02:34 -0500