Executive brief
GStreamer is a widely used framework for handling multimedia files like videos and audio. A vulnerability in its FLIC video decoder allows a remote attacker to potentially take control of a computer or crash applications by tricking the system into processing a specially crafted media file. This could lead to unauthorized access to sensitive data or a complete disruption of services that rely on GStreamer for media playback.
Technical details
A heap-based buffer overflow exists in the flx_decode_delta_fli function within gst/flx/gstflxdec.c of the GStreamer FLIC decoder. The vulnerability is triggered by an improper handling of the start_line parameter in FLIC media files. A remote, unauthenticated attacker can exploit this by providing a specially crafted FLIC file to an application using the GStreamer library. Successful exploitation can lead to arbitrary code execution with the privileges of the user running the application or a denial of service (application crash). The issue was addressed in GStreamer version 1.10.2; some distributions like Red Hat opted to remove the vulnerable plug-in as a mitigation.
Affected products
- GStreamer GStreamer before 1.10.2
- Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7
- Debian debian_linux 8.0
Timeline
- 2016-11-24: disclosed: Public disclosure via oss-security mailing list
- 2016-12-21: patched: Red Hat released security updates for RHEL 6
- 2017-01-05: patched: Red Hat released security updates for RHEL 7
- 2017-01-27: advisory: NVD published CVE-2016-9634
References
- http://rhn.redhat.com/errata/RHSA-2016-2975.html
- http://rhn.redhat.com/errata/RHSA-2017-0019.html
- http://rhn.redhat.com/errata/RHSA-2017-0020.html
- http://www.debian.org/security/2016/dsa-3723
- http://www.debian.org/security/2016/dsa-3724
- http://www.openwall.com/lists/oss-security/2016/11/24/2
- http://www.securityfocus.com/bid/94499