=====================================================================
                                     CERT-Renater

                          Note d'Information No. 2007/VULN101
_____________________________________________________________________

DATE                      : 13/03/2007

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running MPlayer.

======================================================================
http://xforce.iss.net/xforce/xfdb/32747
______________________________________________________________________

MPlayer DMO_VideoDecoder() buffer overflow
mplayer-dmovideodecoder-bo (32747) 	The risk level is classified as HighHigh Risk

Description:

MPlayer is vulnerable to a buffer overflow, caused by improper bounds checking 
by the DMO_VideoDecoder function. By creating a specially-crafted video file 
with an overly long biSize value, a remote attacker could overflow a buffer and 
execute arbitrary code on the system or cause the application to crash, if the 
attacker could persuade the victim to open the malicious video file.

Platforms Affected:

     * Apple Computer, Inc.: Mac OS X Any version
     * Data General: DG/UX Any version
     * Hewlett-Packard Company: HP-UX Any version
     * Hewlett-Packard Company: Tru64 UNIX Any version
     * IBM: AIX Any version
     * IBM: OS/2 Any version
     * Linux: Linux Any version
     * Microsoft Corporation: Windows 95
     * Microsoft Corporation: Windows 98
     * Microsoft Corporation: Windows 98 Second Edition
     * Microsoft Corporation: Windows Me
     * Microsoft Corporation: Windows XP
     * Microsoft Corporation: Windows 2000 Any version
     * Microsoft Corporation: Windows 2003 Any version
     * Microsoft Corporation: Windows NT 4.0
     * Mplayer: Mplayer 1.0rc1
     * Santa Cruz Operation, Inc.: SCO Unix Any version
     * SGI: IRIX Any version
     * Sun Microsystems, Inc.: Solaris Any version
     * Wind River Systems, Inc.: BSD Any version

Remedy:

Upgrade to the latest version of MPlayer (1.0rc1 trunk after 2/11/2007 or 
later), available from the MPlayer Web site. See References.

Consequences:

Gain Access

References:

     * Full-Disclosure Mailing List, Thu Mar 1 12:08:45 GMT 2007 , MPlayer DMO 
buffer overflow at 
http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052738.html.
     * MPlayer Web site, MPlayer - The Movie Player at 
http://www.mplayerhq.hu/design7/news.html.

Standards associated with this entry:

     * BID-22771: MPlayer DMO File Parsing Buffer Overflow Vulnerability
     * CVE-2007-1246: The DMO_VideoDecoder_Open function in 
loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier does not set the 
biSize before use in a memcpy, which allows user-assisted remote attackers to 
cause a buffer overflow and possibly execute arbitrary code.

Reported:

Mar 01, 2007

The information within this database may change without notice. Use of this 
information constitutes acceptance for use in an AS IS condition. There are NO 
warranties, implied or otherwise, with regard to this information or its use. 
Any use of this information is at the user's risk. In no event shall the 
author/distributor (Internet Security Systems X-Force) be held liable for any 
damages whatsoever arising out of or in connection with the use or spread of 
this information.

Copyright (c) 1994-2007 Internet Security Systems, Inc. All rights reserved 
worldwide.

======================================================================

            =========================================================
            Les serveurs de référence du CERT-Renater
            http://www.urec.fr/securite
            http://www.cru.fr/securite
            http://www.renater.fr
            =========================================================
            + CERT-RENATER          | tel : 01-53-94-20-44          +
            + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
            + 75013 Paris           | email: certsvp@renater.fr     +
            =========================================================