CAN-2005-2967: Format string vulnerability in xine-lib's CDDB response parsing
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
xine-lib (Debian) |
Fix Released
|
Unknown
|
|||
xine-lib (Ubuntu) |
Fix Released
|
High
|
Martin Pitt |
Bug Description
Automatically imported from Debian bug report #332919 http://
CVE References
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #1 |
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #2 |
Message-Id: <email address hidden>
Date: Sun, 09 Oct 2005 15:58:36 +0200
From: Moritz Muehlenhoff <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: CAN-2005-2967: Format string vulnerability in xine-lib's CDDB response
parsing
Package: xine-lib
Severity: grave
Tags: security
Justification: user security hole
A format string vulnerability in xine-lib's CDDB response parsing has been found.
Exploitation is quite unlikely, as it would require a rogue CDDB server, but it
should be fixed nevertheless, as the fix is trivial. Please see
http://
details and a patch.
Cheers,
Moritz
-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.14-rc1
Locale: LANG=C, LC_CTYPE=
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#3 |
No, you don't need to set up a rogue CDDB server, as CDDB servers let anyone add or modify information about records.
http://
// Ulf
--
_______
Surf the Web in a faster, safer and easier way:
Download Opera 8 at http://
Powered by Outblaze
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#4 |
Ulf Harnhammar wrote:
> No, you don't need to set up a rogue CDDB server, as CDDB servers let anyone add or modify information about records.
But according to the freedb.org FAQs every submission is reviewed before being
applied to the database. So it seems quite unlikely submissions of crafted entries
to exploit this vulnerability would pass this stage.
Cheers,
Moritz
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #5 |
Message-Id: <email address hidden>
Date: Tue, 11 Oct 2005 12:26:10 +0100
From: "Ulf Harnhammar" <email address hidden>
To: <email address hidden>
Cc: <email address hidden>
Subject: No
No, you don't need to set up a rogue CDDB server, as CDDB servers let anyon=
e add or modify information about records.
http://
=3D26
// Ulf
--=20
_______
Surf the Web in a faster, safer and easier way:
Download Opera 8 at http://
Powered by Outblaze
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #6 |
Message-ID: <email address hidden>
Date: Tue, 11 Oct 2005 13:59:37 +0200
From: Moritz Muehlenhoff <email address hidden>
To: Ulf Harnhammar <email address hidden>
Cc: <email address hidden>
Subject: Re: No
Ulf Harnhammar wrote:
> No, you don't need to set up a rogue CDDB server, as CDDB servers let anyone add or modify information about records.
But according to the freedb.org FAQs every submission is reviewed before being
applied to the database. So it seems quite unlikely submissions of crafted entries
to exploit this vulnerability would pass this stage.
Cheers,
Moritz
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Martin Pitt (pitti) wrote : | #7 |
stables were fixed in USN-196-1, breezy is fixed as well.
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#8 |
> > No, you don't need to set up a rogue CDDB server, as CDDB servers
> > let anyone add or modify information about records.
>
> But according to the freedb.org FAQs every submission is reviewed before being
> applied to the database. So it seems quite unlikely submissions of
> crafted entries
> to exploit this vulnerability would pass this stage.
I can't find any place in the FAQ or the web site where it says that. On the contrary:
"Many users submit, and we are (automatically) trying to sort the bad entries out but we cannot guarantee that all submitted data is correct."
http://
"We update our master server as well as the mirrors with new submissions several times a day."
http://
They had about 19600 submissions last week:
http://
I think that's pretty conclusive evidence that they don't review the submitted entries.
It should also be noted that if you don't patch xine-lib, you have to trust the freedb.org people 100%, which I'm not willing to do. (I trust debian.org and ftp.sunet.se where I download .debs from, but they both have a reputation and a history.)
// Ulf
--
_______
Surf the Web in a faster, safer and easier way:
Download Opera 8 at http://
Powered by Outblaze
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #9 |
Message-Id: <email address hidden>
Date: Wed, 12 Oct 2005 12:27:17 +0100
From: "Ulf Harnhammar" <email address hidden>
To: "Moritz Muehlenhoff" <email address hidden>
Cc: <email address hidden>
Subject: Re: No
> > No, you don't need to set up a rogue CDDB server, as CDDB servers=20
> > let anyone add or modify information about records.
>=20
> But according to the freedb.org FAQs every submission is reviewed before =
being
> applied to the database. So it seems quite unlikely submissions of=20
> crafted entries
> to exploit this vulnerability would pass this stage.
I can't find any place in the FAQ or the web site where it says that. On th=
e contrary:
"Many users submit, and we are (automatically) trying to sort the bad entri=
es out but we cannot guarantee that all submitted data is correct."
http://
=3D4
"We update our master server as well as the mirrors with new submissions se=
veral times a day."
http://
=3D26
They had about 19600 submissions last week:
http://
I think that's pretty conclusive evidence that they don't review the submit=
ted entries.
It should also be noted that if you don't patch xine-lib, you have to trust=
the freedb.org people 100%, which I'm not willing to do. (I trust debian.o=
rg and ftp.sunet.se where I download .debs from, but they both have a reput=
ation and a history.)
// Ulf
--=20
_______
Surf the Web in a faster, safer and easier way:
Download Opera 8 at http://
Powered by Outblaze
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#10 |
# Automatically generated email from bts, devscripts version 2.9.8
reassign 333682 xine-lib
merge 333682 332919
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #11 |
Message-Id: <email address hidden>
Date: Wed, 19 Oct 2005 22:09:11 -0400
From: Joey Hess <email address hidden>
To: <email address hidden>
Subject: reassign 333682 to xine-lib, merging 333682 332919
# Automatically generated email from bts, devscripts version 2.9.8
reassign 333682 xine-lib
merge 333682 332919
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #12 |
*** Bug 24302 has been marked as a duplicate of this bug. ***
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#13 |
On Tue, 2005-11-22 at 23:31 +0100, Jérôme Marant wrote:
> Hi,
>
> I've just noticed that this security bug has not been fixed:
>
> #332919: CAN-2005-2967: Format string vulnerability in xine-lib's CDDB response parsing
>
> Any action taken?
This bug has been addressed for stable in DSA-863, it's only etch/sid
which have to be fixed. The package has two maintainers, but I can't
trace recent activity for any of them.
I've prepared updated packages for xine-lib, which fix this security
issue and the FTBFS-bug. They thus fix 2 RC bugs (or 3 if you count
merged separately). The diff is attached, the updated packages can be
found here: http://
Since I can't upload them myself, maybe someone else can review and
upload?
regards,
Thijs
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #14 |
Message-Id: <email address hidden>
Date: Wed, 23 Nov 2005 10:33:33 +0100
From: Thijs Kinkhorst <email address hidden>
To: <email address hidden>, <email address hidden>, <email address hidden>,
=?ISO-
Cc: <email address hidden>, <email address hidden>, <email address hidden>
Subject: Re: #332919 Still not fixed
--=-4kijn+
Content-Type: multipart/mixed; boundary=
--=-QaeWL16TumS
Content-Type: text/plain; charset=ISO-8859-1
Content-
On Tue, 2005-11-22 at 23:31 +0100, J=E9r=F4me Marant wrote:
> Hi,
>=20
> I've just noticed that this security bug has not been fixed:
>=20
> #332919: CAN-2005-2967: Format string vulnerability in xine-lib's CDDB =
response parsing
>=20
> Any action taken?
This bug has been addressed for stable in DSA-863, it's only etch/sid
which have to be fixed. The package has two maintainers, but I can't
trace recent activity for any of them.
I've prepared updated packages for xine-lib, which fix this security
issue and the FTBFS-bug. They thus fix 2 RC bugs (or 3 if you count
merged separately). The diff is attached, the updated packages can be
found here: http://
Since I can't upload them myself, maybe someone else can review and
upload?
regards,
Thijs
--=-QaeWL16TumS
Content-
Content-Type: text/x-patch; name=xine-
Content-
ZGlmZiAtdSB4aW5
L3J1bGVzDQotLS0
LjEvZGViaWFuL3J
ZXN0DQogCWRoX2l
IG5ldmVyIGhhdmU
c2hhcmUvZG9jL3h
ZTEvdXNyL3NoYXJ
eGluZS9mYXEgXA0
bXYgZGViaWFuL3R
eGluZTEvdXNyL3N
aGFuZ2VMb2cNCiA
ZWJpYW4vY2hhbmd
LWxpYi0xLjAuMS9
YW5nZWxvZw0KQEA
OyB1cmdlbmN5PWh
dXJpdHktKWJ1Z3M
IGEgZm9ybWF0IHN
c2luZyAoQ1ZFLTI
IGJhc2hpc20gaW4
KS4NCisNCisgLS0
IDIzIE5vdiAyMDA
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#15 |
tag 332919 + pending
thanks
I'm presently uploading Thijs' NMU.
Steve Langasek wrote:
> On Wed, Nov 23, 2005 at 09:15:29PM +0100, Thomas Viehmann wrote:
[build-problem]
> This is an accidental dependency on i386 only due to a samba misbuild. It
> should be fixed as soon as samba gets binNMUed (autobuilder binNMUs are
> currently down for maintenance).
Ah. Thanks for the info. So I've built xine-lib with a local binNMU of
samba on i386 and am uploading the xine-lib NMU.
Kind regards
T.
--
Thomas Viehmann, http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#16 |
tag 332919 + fixed
tag 333682 + fixed
tag 337996 + fixed
quit
This message was generated automatically in response to a
non-maintainer upload. The .changes file follows.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Wed, 23 Nov 2005 09:42:39 +0100
Source: xine-lib
Binary: libxine-dev libxine1
Architecture: source i386
Version: 1.0.1-1.4
Distribution: unstable
Urgency: high
Maintainer: Siggi Langauf <email address hidden>
Changed-By: Thijs Kinkhorst <email address hidden>
Description:
libxine-dev - the xine video player library, development packages
libxine1 - the xine video/media player library, binary files
Closes: 332919 333682 337996
Changes:
xine-lib (1.0.1-1.4) unstable; urgency=high
.
* Non-maintainer upload for RC-(security-)bugs.
* Apply patch from Ulf Harnhammar fixing a format string vulnerability
in CDDB response parsing (CVE-2005-2967, Closes: #332919, #333682).
* Fix bashism in debian/rules causing a FTBFS (Closes: #337996).
Files:
4f201c064f874c
9f48de634d231a
41e688e6954731
864da56df34734
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: GnuPG key at <http://
iD8DBQFDhZ3zriZ
yedfa5GWYm6Tpn0
=QsWX
-----END PGP SIGNATURE-----
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #17 |
Message-ID: <email address hidden>
Date: Thu, 24 Nov 2005 13:02:45 +0100
From: Thomas Viehmann <email address hidden>
To: Steve Langasek <email address hidden>, <email address hidden>,
<email address hidden>
Cc: Thijs Kinkhorst <email address hidden>,
<email address hidden>
Subject: Re: #332919 Still not fixed
tag 332919 + pending
thanks
I'm presently uploading Thijs' NMU.
Steve Langasek wrote:
> On Wed, Nov 23, 2005 at 09:15:29PM +0100, Thomas Viehmann wrote:
[build-problem]
> This is an accidental dependency on i386 only due to a samba misbuild. It
> should be fixed as soon as samba gets binNMUed (autobuilder binNMUs are
> currently down for maintenance).
Ah. Thanks for the info. So I've built xine-lib with a local binNMU of
samba on i386 and am uploading the xine-lib NMU.
Kind regards
T.
--
Thomas Viehmann, http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #18 |
Message-Id: <email address hidden>
Date: Thu, 24 Nov 2005 04:17:07 -0800
From: Thijs Kinkhorst <email address hidden>
To: <email address hidden>
Cc: Thijs Kinkhorst <email address hidden>, Siggi Langauf <email address hidden>
Subject: Fixed in NMU of xine-lib 1.0.1-1.4
tag 332919 + fixed
tag 333682 + fixed
tag 337996 + fixed
quit
This message was generated automatically in response to a
non-maintainer upload. The .changes file follows.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Wed, 23 Nov 2005 09:42:39 +0100
Source: xine-lib
Binary: libxine-dev libxine1
Architecture: source i386
Version: 1.0.1-1.4
Distribution: unstable
Urgency: high
Maintainer: Siggi Langauf <email address hidden>
Changed-By: Thijs Kinkhorst <email address hidden>
Description:
libxine-dev - the xine video player library, development packages
libxine1 - the xine video/media player library, binary files
Closes: 332919 333682 337996
Changes:
xine-lib (1.0.1-1.4) unstable; urgency=high
.
* Non-maintainer upload for RC-(security-)bugs.
* Apply patch from Ulf Harnhammar fixing a format string vulnerability
in CDDB response parsing (CVE-2005-2967, Closes: #332919, #333682).
* Fix bashism in debian/rules causing a FTBFS (Closes: #337996).
Files:
4f201c064f874c
9f48de634d231a
41e688e6954731
864da56df34734
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: GnuPG key at <http://
iD8DBQFDhZ3zriZ
yedfa5GWYm6Tpn0
=QsWX
-----END PGP SIGNATURE-----
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#19 |
Source: xine-lib
Source-Version: 1.1.1-1
We believe that the bug you reported is fixed in the latest version of
xine-lib, which is due to be installed in the Debian FTP archive:
libxine-
to pool/main/
libxine1_
to pool/main/
xine-lib_
to pool/main/
xine-lib_
to pool/main/
xine-lib_
to pool/main/
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Reinhard Tartler <email address hidden> (supplier of updated xine-lib package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sun, 19 Feb 2006 18:34:51 +0100
Source: xine-lib
Binary: libxine-dev libxine1
Architecture: source i386
Version: 1.1.1-1
Distribution: unstable
Urgency: low
Maintainer: Siggi Langauf <email address hidden>
Changed-By: Reinhard Tartler <email address hidden>
Description:
libxine-dev - the xine video player library, development packages
libxine1 - the xine video/media player library, binary files
Closes: 288189 315986 318838 320317 323276 325960 326935 326936 327203 328168 328184 328265 328454 332919 337996 337997 338000 342208 345499 346488 347162 353150
Changes:
xine-lib (1.1.1-1) unstable; urgency=low
.
* New upstream release! (Closes: #326936, #353150, #332919)
.
[ Reinhard Tartler ]
- adding myself to uploaders
- Remove build dependencies on xlibs-dev, as well as alternatives on
(Closes: #337997, #346488, #345499, #342208, #347162)
- Rechecking the long list of NMUs. Thanks to all submitters!
.
[ Darren Salt ]
- Add debian/watch file for uscan.
- Convert debian/copyright to UTF-8.
- Add build-deps on libxv-dev and libvcdinfo-dev.
- Bump standards version to 3.6.2
- Make "post-Sarge"-tagged changes to debian/rules and strip debian/tmp/
from debian/*.install.
- Remove *.gmo on clean (Just In Case). (Closes: #338000)
- Do a little preparation for a possible -dbg package.
.
* Acknowledge NMUs.
- Backports and gcc 4.0 fixes dropped since they're already in this version.
Closes: #288189, #318838
- slang transition: Closes: #315986
- aalib transition: Closes: #320317, #323276
- flac transition: Closes: #325960
- fix of dependency generation script debian/
Closes: #326935, #327203, #328168, #328184, #328265, #328454
- fix bashism in debian/rules: Closes: #337996
Files:
3a7bb1c2929653
b1f42602c...
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#20 |
Package: xine-lib
Version:
--- Please enter the report below this line. ---
--- System information. ---
Architecture: i386
Kernel: Linux 2.6.18-4-686
Debian Release: 4.0
500 testing security.debian.org
500 testing ftp.de.debian.org
50 unstable www.debian-
50 unstable ftp.debian-
50 unstable ftp.de.debian.org
1 experimental ftp.de.debian.org
--- Package information. ---
Depends (Version) | Installed
=======
Automatically imported from Debian bug report #332919 http:// bugs.debian. org/332919