Junglewise Threat Intelligence

CVE-2016-9812: GStreamer gst-plugins-bad out-of-bounds read in gst_mpegts_section_new

CVE-2016-9812 · Severity: high · CVSS 7.5 · Published 2017-01-13

Technologies: Gstreamer Gst-Plugins-Bad, Red Hat Enterprise Linux 7, Gstreamer. Vendors: Gstreamer, Red Hat.

Executive brief

GStreamer is a widely used multimedia framework that allows applications to play, record, and edit audio and video. A vulnerability in its MPEG-TS decoder could allow a remote attacker to crash applications using the library by providing a specially crafted media file. This could lead to service disruptions or application instability for users opening malicious content.

Technical details

An out-of-bounds read vulnerability exists in the gst_mpegts_section_new function within GStreamer's mpegts decoder (part of gst-plugins-bad). The root cause is insufficient validation of the section size; specifically, the decoder fails to ensure that a section meets the minimum required length (3 bytes for short headers or 11 bytes for non-short headers). A remote attacker can exploit this by providing a malformed MPEG-TS stream or file with a 'too small' section, leading to an invalid memory read and a subsequent crash (Denial of Service). The issue was addressed in GStreamer version 1.10.2.

Affected products

  • GStreamer GStreamer gst-plugins-bad before 1.10.2
  • Red Hat Enterprise Linux 7 gstreamer1-plugins-bad-free before 1.4.5-6.el7_3

Timeline

  • 2016-12-01: disclosed: Initial public disclosure by Hanno Böck
  • 2016-12-01: patched: Fixed in GStreamer 1.10.2 release
  • 2017-01-05: advisory: Red Hat security advisory RHSA-2017:0021 published
  • 2017-01-13: advisory: NVD publication date

References

Related threats