Executive brief
GStreamer, a widely used framework for handling multimedia files on Linux and other systems, contains a flaw in how it processes certain video files. An attacker can provide a specially crafted MPEG-TS video file that, when opened by a user, causes the application to crash. This results in a denial of service, potentially interrupting business operations or media playback services.
Technical details
A NULL pointer dereference vulnerability exists in the GStreamer 'gst-plugins-bad' package within the MPEG-TS (mpegts) parser component. The flaw is located in the _parse_pat function and is triggered when processing a malformed Program Association Table (PAT) in a crafted media stream. An attacker can exploit this by enticing a user to open a malicious file or stream, leading to a segmentation fault and application crash. The vulnerability was addressed in GStreamer version 1.10.2 and backported to various Linux distributions.
Affected products
- GStreamer GStreamer before 1.10.2
- Red Hat gstreamer1-plugins-bad-free Enterprise Linux 7
- Debian gst-plugins-bad1.0 before 1.4.4-2.1+deb8u2 (jessie), before 1.10.4-1 (stretch/sid)
Timeline
- 2016-12-01: disclosed: Public disclosure on oss-security mailing list
- 2016-12-01: patched: Fixed in GStreamer 1.10.2 release
- 2017-01-05: advisory: Red Hat security advisory RHSA-2017:0021 published
- 2017-01-13: advisory: NVD published CVE-2016-9813
References
- http://rhn.redhat.com/errata/RHSA-2017-0021.html
- http://www.debian.org/security/2017/dsa-3818
- http://www.openwall.com/lists/oss-security/2016/12/01/2
- http://www.openwall.com/lists/oss-security/2016/12/05/8
- http://www.securityfocus.com/bid/95158
- https://bugzilla.gnome.org/show_bug.cgi?id=775120
- https://gstreamer.freedesktop.org/releases/1.10/