CVE-2016-9809: GStreamer off-by-one error in H.264 parser

CVE-2016-9809 · Severity: high · CVSS 7.8 · Published 2017-01-13

GStreamer, a widely used multimedia framework for processing audio and video, contains a vulnerability in its H.264 video parsing component. An attacker can exploit this by providing a specially crafted video file that, when opened by a user, causes the application to crash or potentially leak sensitive information. This affects various Linux distributions and any software relying on GStreamer for media playback.

Technologies: Gstreamer, Red Hat Gstreamer-Plugins-Bad-Free. Vendors: Debian, Gstreamer, Red Hat.

Quick answers

Is CVE-2016-9809 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2016-9809 being exploited in the wild.
How severe is CVE-2016-9809?
High severity, with a CVSS score of 7.8, published 13 January 2017.
Which products and versions are affected?
Debian Gst-Plugins-Bad1.0 8 (jessie); Red Hat Gstreamer-Plugins-Bad-Free Enterprise Linux 7.
Is there a fix for CVE-2016-9809?
A patch was published on 2017-01-05: Red Hat released security updates (RHSA-2017:0018, RHSA-2017:0021) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-9809 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2016-9809?
Check whether you run Debian Gst-Plugins-Bad1.0, Gstreamer, GStreamer Bad Plugins or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An off-by-one error exists in the 'gst_h264_parse_set_caps' function within GStreamer's H.264 parsing component. The vulnerability is triggered when the parser processes a malformed H.264 stream, leading to an out-of-bounds read. While primarily identified as a cause for application crashes (Denial of Service), out-of-bounds reads can sometimes be leveraged for information disclosure or, in complex scenarios, memory corruption. The attack vector requires a user to open a crafted file (User Interaction) using an application linked against the vulnerable GStreamer library. The issue was addressed in GStreamer version 1.10.2.

Affected products

  • GStreamer GStreamer before 1.10.2
  • Red Hat gstreamer-plugins-bad-free Enterprise Linux 7
  • Debian gst-plugins-bad1.0 8 (jessie)

Timeline

  • 2016-12-01: disclosed: Initial public disclosure on oss-security mailing list
  • 2017-01-05: patched: Red Hat released security updates (RHSA-2017:0018, RHSA-2017:0021)
  • 2017-01-13: advisory: NVD published CVE-2016-9809
  • 2017-03-27: patched: Debian released security update (DSA-3818-1)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.