Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:26770
HistoryAug 03, 2011 - 12:00 a.m.

NGS00068 Technical Advisory - LibAVCodec AMV Out of Array Write

2011-08-0300:00:00
vulners.com
15

=======
Summary

Name: LibAVCodec AMV Out of Array Write
Release Date: 31 July 2011
Reference: NGS00068
Discoverer: Dominic Chell <[email protected]>
Vendor: VideoLAN
Vendor Reference: CVE-2011-1931
Systems Affected: VLC media player 1.1.9 and earlier releases
Risk: High
Status: Published

========
TimeLine

Discovered: 31 March 2011
Released: 31 March 2011
Approved: 31 March 2011
Reported: 21 April 2011
Fixed: 21 April 2011
Published: 31 July 2011

===========
Description

Dominic Chell of NGS Secure has discovered a high risk vulnerability in LibAVCodec. Opening a
malformed AMV file can result in an out of array write and potentially arbitrary code execution
when using this library. Whilst the vulnerability may affect multiple applications that use
this library, it was only tested on VLC media player.

=================
Technical Details

(b80.d80): Access violation - code c0000005 (first chance) First chance exceptions are
reported before any exception handling.
This exception may be expected and handled.
eax=ffffff60 ebx=11186110 ecx=0e420ec0 edx=fffffe20 esi=00000100
edi=a2a6c008
eip=0ad3e272 esp=0ef8fa08 ebp=0e607070 iopl=0 nv up ei pl nz na pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010206
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program
Files\VideoLAN\VLC\plugins\libavcodec_plugin.dll -
libavcodec_plugin!vlc_entry__1_1_0g+0x33cef2:
0ad3e272 0f7f2443 movq mmword ptr [ebx+eax*2],mm4
ds:0023:11185fd0=???
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
0:008> !exploitable
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program
Files\VideoLAN\VLC\libvlccore.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
C:\WINDOWS\system32\msvcrt.dll -

Exploitability Classification: EXPLOITABLE Recommended Bug Title: Exploitable - User Mode
Write AV starting at
libavcodec_plugin!vlc_entry__1_1_0g+0x33cef2 (Hash=0x64744c60.0x724a4f4e)

User mode write access violations that are not near NULL are exploitable.

diff --git a/libavcodec/sp5xdec.c b/libavcodec/sp5xdec.c index 8bcdbe4…dd31eda 100644 (file)
— a/libavcodec/sp5xdec.c
+++ b/libavcodec/sp5xdec.c
@@ -86,7 +86,6 @@ static int sp5x_decode_frame(AVCodecContext *avctx,
recoded[j++] = 0xFF;
recoded[j++] = 0xD9;

  • avctx->flags &= ~CODEC_FLAG_EMU_EDGE;
    av_init_packet(&avpkt_recoded);
    avpkt_recoded.data = recoded;
    avpkt_recoded.size = j;
    @@ -121,6 +120,6 @@ AVCodec ff_amv_decoder = {
    NULL,
    ff_mjpeg_decode_end,
    sp5x_decode_frame,
  • CODEC_CAP_DR1,
  • 0,
    .long_name = NULL_IF_CONFIG_SMALL("AMV Video"), };

===============
Fix Information

http://git.videolan.org/?p=ffmpeg.git;a=commit;h=89f903b3d5ec38c9c5d90fba7e626fa0eda61a32

NGS Secure Research
http://www.ngssecure.com