CVE-2016-9634: GStreamer heap buffer overflow in FLIC decoder

CVE-2016-9634 · Severity: critical · CVSS 9.8 · Published 2017-01-27

GStreamer is a widely used framework for handling multimedia files like videos and audio. A vulnerability in its FLIC video decoder allows a remote attacker to potentially take control of a computer or crash applications by tricking the system into processing a specially crafted media file. This could lead to unauthorized access to sensitive data or a complete disruption of services that rely on GStreamer for media playback.

Technologies: Debian Linux, Gstreamer, Red Hat GStreamer Plugins Good, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation. Vendors: Debian, Gstreamer, Red Hat, Redhat.

Quick answers

Is CVE-2016-9634 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2016-9634 being exploited in the wild.
How severe is CVE-2016-9634?
Critical severity, with a CVSS score of 9.8, published 27 January 2017.
Which products and versions are affected?
GStreamer GStreamer before 1.10.2; Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7; Debian debian_linux 8.0.
Is there a fix for CVE-2016-9634?
A patch was published on 2016-12-21: Red Hat released security updates for RHEL 6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-9634 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2016-9634?
Check whether you run Debian Linux, Gstreamer, Red Hat GStreamer Plugins Good or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the flx_decode_delta_fli function within gst/flx/gstflxdec.c of the GStreamer FLIC decoder. The vulnerability is triggered by an improper handling of the start_line parameter in FLIC media files. A remote, unauthenticated attacker can exploit this by providing a specially crafted FLIC file to an application using the GStreamer library. Successful exploitation can lead to arbitrary code execution with the privileges of the user running the application or a denial of service (application crash). The issue was addressed in GStreamer version 1.10.2; some distributions like Red Hat opted to remove the vulnerable plug-in as a mitigation.

Affected products

  • GStreamer GStreamer before 1.10.2
  • Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7
  • Debian debian_linux 8.0

Timeline

  • 2016-11-24: disclosed: Public disclosure via oss-security mailing list
  • 2016-12-21: patched: Red Hat released security updates for RHEL 6
  • 2017-01-05: patched: Red Hat released security updates for RHEL 7
  • 2017-01-27: advisory: NVD published CVE-2016-9634

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.