Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2007.0441 -- [UNIX/Linux][Debian]
New MPlayer packages fix arbitrary code execution
20 June 2007
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: mplayer
Publisher: Debian
Operating System: Debian GNU/Linux 4.0
UNIX variants (UNIX, Linux, OSX)
Impact: Execute Arbitrary Code/Commands
Access: Remote/Unauthenticated
CVE Names: CVE-2007-2948
Original Bulletin: http://www.debian.org/security/2007/dsa-1313
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running mplayer check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - --------------------------------------------------------------------------
Debian Security Advisory DSA 1313-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
June 19th, 2007 http://www.debian.org/security/faq
- - --------------------------------------------------------------------------
Package : mplayer
Vulnerability : buffer overflow
Problem-Type : remote
Debian-specific: no
CVE ID : CVE-2007-2948
Stefan Cornelius and Reimar Doeffinger discovered that the MPlayer movie
player performs insufficient boundary checks when accessing CDDB data,
which might lead to the execution of arbitrary code.
The oldstable distribution (sarge) doesn't include MPlayer packages.
For the stable distribution (etch) this problem has been fixed in
version 1.0~rc1-12etch1.
For the unstable distribution (sid) this problem has been fixed in
version 1.0~rc1-14.
We recommend that you upgrade your mplayer package.
Upgrade Instructions
- - --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- - -------------------------------
Source archives:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1.dsc
Size/MD5 checksum: 1265 6d0b64ba23476545f12d569535d32b13
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1.diff.gz
Size/MD5 checksum: 84073 3408d0ce7dd69254e4478bb3131656e5
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1.orig.tar.gz
Size/MD5 checksum: 10286260 815482129b79cb9390904b145c5def6c
Architecture independent components:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer-doc_1.0~rc1-12etch1_all.deb
Size/MD5 checksum: 2048072 82908ef42c42b0afbcd120f26d979b7d
Alpha architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_alpha.deb
Size/MD5 checksum: 4705284 469cef81b7b33e3e685357e65aae8206
AMD64 architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_amd64.deb
Size/MD5 checksum: 4373766 d10104203e02ea2dd261175182e2490b
ARM architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_arm.deb
Size/MD5 checksum: 4325882 3b11a9419811afee20430d7ea0aec792
HP Precision architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_hppa.deb
Size/MD5 checksum: 4383252 70286fae370f01d4749305f2b8240362
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_i386.deb
Size/MD5 checksum: 4421296 14dd476d508436d0307573082ae00913
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_ia64.deb
Size/MD5 checksum: 5841084 c89e50a887abf7d5bf9d351459b57346
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_mips.deb
Size/MD5 checksum: 4274962 e0038a856d692f37da6b721065abace2
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_mipsel.deb
Size/MD5 checksum: 4278448 129388e3f9f1046189d1a0cd6725a3e1
PowerPC architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_powerpc.deb
Size/MD5 checksum: 4341660 64cedae430b777fb0521c2f934203780
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_s390.deb
Size/MD5 checksum: 4162858 80507ecf4866899227edf86e2557ca88
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/m/mplayer/mplayer_1.0~rc1-12etch1_sparc.deb
Size/MD5 checksum: 4037328 44b1191fbc3702f0b72d54e58bbb68ac
These files will probably be moved into the stable distribution on
its next update.
- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFGeBXiXm3vHE4uyloRAjY9AJ9PS73FgS7Z5DOCMmWhaL3U18niygCdHbpM
WisP1Thke+D0xfRzL69J1ds=
=VKHO
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBRnh+byh9+71yA2DNAQKcfQP/U4Y6PBkXDl2pZuaE2qtX1WKorGNFFs5x
SwTS4flveI+pZn5ddlk4AZL0sw+FUq/mYkKNARNFHOoJ8R4QLtN93p4fZHdqY8DO
p85F8ECb63XuWKKOzNiI4p8NE+8TLqKm3nwlkmJTRQB2aL4CbKUlDjK2E9XrTbxm
JSV2DFJZM1A=
=40vI
-----END PGP SIGNATURE-----