发布日期：2006-12-04
更新日期：2007-03-01

受影响系统：

MPlayer MPlayer 1.x
MPlayer MPlayer 0.x
xine xine-lib < 1.1.3

不受影响系统：

xine xine-lib 1.1.3

描述：

---

BUGTRAQ  ID: 21435
CVE(CAN) ID: CVE-2006-6172

xine是一款免费的媒体播放器，支持多种格式。

xine的Real Media输入插件的asmrp_match()函数中存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。

在以下代码段中，rulematches是仅能容纳16个int的静态缓冲区，但asmrp_match()没有对参数执行边界检查：

>8--------------------------------------------8<
src/input/libreal/real.c:468

for (i=0; i<desc->stream_count; i++) {

int j=0;
int n;
char b[64];
int rulematches[16];

lprintf("calling asmrp_match with:\n%s\n%u", desc->stream[i]->asm_rule_book, bandwidth);

n=asmrp_match(desc->stream[i]->asm_rule_book, bandwidth, rulematches);

攻击者可以通过创建拥有大量rulematches的rulebook来触发这个溢出，导致拒绝服务或执行任意代码。

<*来源：Roland Kay
  
  链接：http://sourceforge.net/tracker/index.php?func=detail&aid=1603458&group_id=9655&atid=109655
        http://sourceforge.net/project/shownotes.php?release_id=468432
        http://secunia.com/advisories/23218/
        http://marc.theaimsgroup.com/?l=bugtraq&m=116527279913386&w=2
        http://secunia.com/advisories/24336/
        http://www.debian.org/security/2006/dsa-1244
        http://security.gentoo.org/glsa/glsa-200612-02.xml
        http://security.gentoo.org/glsa/glsa-200702-11.xml
*>

建议：

---

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-1244-1）以及相应补丁:
DSA-1244-1：New xine-lib packages fix arbitrary code execution
链接：http://www.debian.org/security/2006/dsa-1244

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/x/xine-lib/xine-lib_1.0.1-1sarge5.dsc
Size/MD5 checksum:     1059 cd19dea4bbccc12c789884056d1468fb
http://security.debian.org/pool/updates/main/x/xine-lib/xine-lib_1.0.1-1sarge5.diff.gz
Size/MD5 checksum:     4435 b8459683695418e142fd4df413417fae
http://security.debian.org/pool/updates/main/x/xine-lib/xine-lib_1.0.1.orig.tar.gz
Size/MD5 checksum:  7774954 9be804b337c6c3a2e202c5a7237cb0f8

Alpha architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_alpha.deb
Size/MD5 checksum:   107742 b2a85d200303ed3505157a2d08d5ae08
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_alpha.deb
Size/MD5 checksum:  4829772 bdc33d1faede7e6494b359c218edda6b

AMD64 architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_amd64.deb
Size/MD5 checksum:   107738 876778a08d5316038e8df0d209a28662
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_amd64.deb
Size/MD5 checksum:  3933538 422c74102dff610b3852d99a055d06ff

ARM architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_arm.deb
Size/MD5 checksum:   107784 0c04a5513f177d86582852ce29c3bad0
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_arm.deb
Size/MD5 checksum:  3878498 f45053d66f38f7304cb7a5f131d30ee6

HP Precision architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_hppa.deb
Size/MD5 checksum:   107758 9e9e197f924a655f3143a4b873a7c61f
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_hppa.deb
Size/MD5 checksum:  3600800 f26c5eaebd2d2454e3a2f2d1b88a2897

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_i386.deb
Size/MD5 checksum:   107734 84dd3db6ac72153194a994265a35f1b8
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_i386.deb
Size/MD5 checksum:  4206006 ca2a6b6c5a6b3fcac6959e79094bc05e

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_ia64.deb
Size/MD5 checksum:   107734 d5a843404804dd120f4d867abc97c152
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_ia64.deb
Size/MD5 checksum:  5620720 75ab1916494e948fd578993e995c8242

Motorola 680x0 architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_m68k.deb
Size/MD5 checksum:   107816 6516980ebb2f7921a6091568f8063725
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_m68k.deb
Size/MD5 checksum:  3175358 983be20c652e0fe3e657e072641d4f2a

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_mips.deb
Size/MD5 checksum:   107772 d8ad5153cbf4d684782dd0eae73acfa4
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_mips.deb
Size/MD5 checksum:  4066822 d08d8b577231e7f8ef831787b10599f2

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_mipsel.deb
Size/MD5 checksum:   107760 f60c90058fa3dfa43d1ee20568732575
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_mipsel.deb
Size/MD5 checksum:  4125586 fd6b6ccf2d7cd70c4c149da5a581fd1e

PowerPC architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_powerpc.deb
Size/MD5 checksum:   107758 d98ab6a9998b4a1fb9f2f847f7ac498d
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_powerpc.deb
Size/MD5 checksum:  4305668 82eacf4f32a4a9c9d6784f8dafe7f5eb

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_s390.deb
Size/MD5 checksum:   107732 3c271479f40a0e87f5833031c7216707
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_s390.deb
Size/MD5 checksum:  3880792 47feaca578c6b5b6551256cd5dca98b0

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/x/xine-lib/libxine-dev_1.0.1-1sarge5_sparc.deb
Size/MD5 checksum:   107756 863e2e6bbdf43a5ce0af40ba3a99fa46
http://security.debian.org/pool/updates/main/x/xine-lib/libxine1_1.0.1-1sarge5_sparc.deb
Size/MD5 checksum:  4360666 6d2643b993298bb133e306e37f68711f

补丁安装方法：

1. 手工安装补丁包：

  首先，使用下面的命令来下载补丁软件：
  # wget url  (url是补丁下载链接地址)

  然后，使用下面的命令来安装补丁：  
  # dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

   首先，使用下面的命令更新内部数据库：
   # apt-get update
  
   然后，使用下面的命令安装更新软件包：
   # apt-get upgrade

MPlayer
-------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.mplayerhq.hu/MPlayer/patches/asmrules_fix_20061231.diff

xine
----
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://xinehq.de/index.php/releases

浏览次数：2904
严重程度：0（网友投票）