Junglewise Threat Intelligence

CVE-2016-9808: GStreamer FLIC decoder out-of-bounds write

CVE-2016-9808 · Severity: high · CVSS 7.5 · Published 2017-01-13

Technologies: Gstreamer, Red Hat GStreamer Plugins Good. Vendors: Gstreamer, Red Hat.

Executive brief

GStreamer is a widely used multimedia framework that allows applications to play, record, and edit audio and video. A vulnerability in its FLIC video decoder allows a remote attacker to crash applications using the library or potentially execute unauthorized code by providing a specially crafted media file. This could lead to service disruptions or a compromise of the system running the affected software.

Technical details

An out-of-bounds write vulnerability exists in the FLIC decoder component of GStreamer (specifically within the gstreamer-plugins-good package). The flaw is triggered when processing a crafted series of 'skip' and 'count' pairs in a FLIC/FLI/FLX media file, leading to a heap-based buffer overflow. A remote, unauthenticated attacker can exploit this by tricking a user or service into processing a malicious media file. Successful exploitation can result in a denial of service (application crash) or arbitrary code execution with the privileges of the user running the GStreamer-linked application. The issue was addressed in GStreamer version 1.10.2, and some vendors like Red Hat addressed it by removing the vulnerable plugin.

Affected products

  • GStreamer GStreamer before 1.10.2
  • Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7

Timeline

  • 2016-11-16: other: Initial public disclosure by third-party researcher
  • 2016-12-21: patched: Red Hat released security updates for RHEL 6
  • 2017-01-05: patched: Red Hat released security updates for RHEL 7
  • 2017-01-13: advisory: NVD published CVE-2016-9808

References

Related threats