OSVDB ID: 25936

Title: xine-lib xineplug_inp_http.so HTTP Response Remote Overflow

Info

Disclosure
May 30, 2006

Discovery
Unknown

Dates

Exploit
May 30, 2006

Solution
Unknown

Description

 A remote overflow exists in xine-lib. The xineplug_inp_http.so library fails to properly check bounds for HTTP responses resulting in a buffer overflow. By tricking a victim into opening an HTTP link to a malicious website, an attacker can cause arbitary code execution on the victim\'s system resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified

Solution

 Upgrade to cvs version (after 2006-05-31) or version 1.1.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

xine-Project

xine-lib

 1.1.1
1.1.0
1.0.2
1.0.1

References

Credit
  • Federico L. Bossi Bonin - fbossinetcomm.com.ar -


Direct URL: http://osvdb.org/25936