Executive brief
GStreamer is a widely used multimedia framework that allows applications to play and process video and audio files. A vulnerability in its FLIC video decoder allows a remote attacker to potentially take control of a system or crash applications by providing a specially crafted video file. This affects any software using the GStreamer library to handle media, potentially leading to unauthorized data access or service disruptions.
Technical details
A heap-based buffer overflow exists in the flx_decode_delta_fli function within gst/flx/gstflxdec.c of the GStreamer FLIC decoder. The vulnerability is triggered when the decoder processes a 'write count' value that exceeds the bounds of the initialized destination buffer. A remote, unauthenticated attacker can exploit this by providing a malicious FLIC (.fli/.flc) media file. Successful exploitation can lead to arbitrary code execution with the privileges of the user running the GStreamer-linked application or a denial of service (application crash). The issue was addressed in GStreamer version 1.10.2, and various Linux distributions (Red Hat, Debian, Gentoo) have released patches that either fix the code or remove the vulnerable plugin.
Affected products
- GStreamer GStreamer before 1.10.2
- Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7
- Debian debian_linux 8.0
Timeline
- 2016-11-24: disclosed: Public disclosure on oss-security mailing list
- 2016-12-21: patched: Red Hat released security updates for RHEL 6
- 2017-01-05: patched: Red Hat released security updates for RHEL 7
- 2017-01-27: advisory: NVD published the CVE record
References
- http://rhn.redhat.com/errata/RHSA-2016-2975.html
- http://rhn.redhat.com/errata/RHSA-2017-0019.html
- http://rhn.redhat.com/errata/RHSA-2017-0020.html
- http://www.debian.org/security/2016/dsa-3723
- http://www.debian.org/security/2016/dsa-3724
- http://www.openwall.com/lists/oss-security/2016/11/24/2
- http://www.securityfocus.com/bid/94499