"xine is a free multimedia player. It plays back CDs, DVDs, and VCDs. It also decodes multimedia files like AVI, MOV, WMV, and MP3 from local disk drives, and displays multimedia streamed over the Internet. It interprets many of the most common multimedia formats available - and some of the most uncommon formats, too."
By setting up a malicious CDDB server, an attacker can overwrite arbitrary memory locations with arbitrary data using Xine based CD Players.
Vulnerable Systems:
* Xine versions 1-beta releases starting with and including 1-beta3
* Xine versions 1-rc releases
* Xine versions 1.0 releases up to and including 1.0.2
* Xine version 1.1.0 release
Immune Systems:
* Xine 0.9 and prior
* Xine versions 1-alpha releases
* Xine versions 1-beta releases prior to 1-beta3
* Xine versions 1.0 releases starting with and including 1.0.3
* Xine version 1.1.1
When playing an Audio CD, using xine-lib based media application, the library contacts a CDDB server to retrieve metadata like the title and artist's name. During processing of this data, a response from the server, which is located in memory on the stack, is passed to the fprintf() function as a format string.
An attacker can set up a malicious CDDB server and trick the client into using this server instead of the pre-configured one. Alternatively, any user and therefore the attacker can modify entries in the official CDDB server. Using this format string vulnerability, attacker-chosen data can be written to an attacker-chosen memory location. This allows the attacker to alter the control flow and to execute malicious code with the permissions of the user running the application.
Although it requires the user to play an Audio CD, this vulnerability can still be exploited remotely, because a xine Audio CD MRL (media resource locator) could be embedded into a website.
{
my $server = IO::Socket::INET->new( Proto => 'tcp',
LocalPort => $main::port,
Listen => SOMAXCONN,
Reuse => 1);
die "can't set up server!\n" unless $server;
while (my $client = $server->accept())
{
$client->autoflush(1);
print 'connection from '.$client->peerhost."\n";
mysend($client, '201 metaur CDDBP server v1.5PL2 ready at '.
scalar localtime);
while (my $str = myreceive($client))
{
if ($str =~ m/^cddb hello ([^ ]+) ([^ ]+) (.+)$/i)
{
mysend($client, "200 Hello and welcome $1\@$2 running $3.");
next;
}
