Back to list
Need information, for MPlayer demux_open_vqf TwinVQ File Handling Buffer Overflow CVE-2008-5616
Jul 22 2009 08:48AM
Rajendra Prasad . Palnaty (rajendra palnaty freescale com)
I am in need of some Information for the below mentioned Vulnerability.
MPlayer demux_open_vqf TwinVQ File Handling Buffer Overflow
MPlayer contains a stack buffer overflow vulnerability while parsing
malformed TwinVQ media files, where TwinVQ (transform-domain weighted
interleaved vector quantization) is an audio compression technique
developed by Nippon Telegraph and Telephone Corporation (NTT). The
vulnerability may be exploited by the remote attacker to execute
arbitrary code in the context of MPlayer. The vulnerable function is
demux_open_vqf() and the vulnerable parameters are Chunk Size of COMM
chunk, and Tag Length of any tag within it. The vulnerable programs
are mplayer, gmplayer and mencoder on Linux-based systems.
Mplayer.exe, gmplayer.exe and mencoder.exe on Windows-based systems.
This issue affects MPlayer 1.0rc2, other versions may also be
* TwinVQ (transform-domain weighted interleaved vector quantization)
is an audio compression technique developed by Nippon Telegraph and
Telephone Corporation (NTT).
* MPlayer contains a stack buffer overflow vulnerability while parsing
malformed TwinVQ media files.
* TWIN constant expression for TWINVQ is always followed by 8 digits
* COMM is the Standard Sub-chunk will fall after 4 byte size relative
to TWIN pattern.
* Data_size from DSIZ subchunk unsigned value is having vulnerability.
* In the malicious packet i analyze, The sub-chunk size is around 8191
bytes ( 0x 00 00 1f ff).
But as per the file format all these sub-chunk fields are very small.
Even if all these sub-chunks
are present, I didn't see that is exceed not more than say around
So can i conclude that If the sub-chunk size is more than the above
mentioned value, we can trigger an
Please help me out in the above mentioned issue
Thanks & Regards
uthraa.c (at) freescale (dot) com [email concealed]
[ reply ]
Copyright 2010, SecurityFocus