csaf_certbund - wid-sec-w-2024-0936

wid-sec-w-2024-0936

Vulnerability from csaf_certbund

Published

2024-04-21 22:00

Modified

2024-09-17 22:00

Summary

GStreamer: Schwachstelle ermöglicht Codeausführung

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

GStreamer ist ein Multimedia-Framework mit einer Plugin-basierten Architektur für eine Vielzahl von Plattformen.

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in GStreamer ausnutzen, um beliebigen Programmcode auszuführen.

Betroffene Betriebssysteme

- Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "GStreamer ist ein Multimedia-Framework mit einer Plugin-basierten Architektur f\u00fcr eine Vielzahl von Plattformen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in GStreamer ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0936 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0936.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0936 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0936"
      },
      {
        "category": "external",
        "summary": "ZDI Advisory vom 2024-04-21",
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-368/"
      },
      {
        "category": "external",
        "summary": "gstreamer Security Advisory vom 2024-04-21",
        "url": "https://gstreamer.freedesktop.org/security/sa-2023-0011.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:2287 vom 2024-04-30",
        "url": "https://access.redhat.com/errata/RHSA-2024:2287"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2024:0305-1 vom 2024-09-17",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/73CSYYN6KCRAUIBATMXYYKQT4I5PVKDJ/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:3289-1 vom 2024-09-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019443.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2024:0305-1 vom 2024-09-17",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/73CSYYN6KCRAUIBATMXYYKQT4I5PVKDJ/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:3295-1 vom 2024-09-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-September/019444.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:3295-1 vom 2024-09-18",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TPXQ4QZZOHID4GKDCPV54NYKT5XHD2JO/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2024:3295-1 vom 2024-09-18",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/TPXQ4QZZOHID4GKDCPV54NYKT5XHD2JO/"
      }
    ],
    "source_lang": "en-US",
    "title": "GStreamer: Schwachstelle erm\u00f6glicht Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2024-09-17T22:00:00.000+00:00",
      "generator": {
        "date": "2024-09-18T11:10:12.396+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2024-0936",
      "initial_release_date": "2024-04-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-04-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-04-29T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-09-17T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von openSUSE und SUSE aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.22.8",
                "product": {
                  "name": "Open Source GStreamer \u003c1.22.8",
                  "product_id": "T034335"
                }
              },
              {
                "category": "product_version",
                "name": "1.22.8",
                "product": {
                  "name": "Open Source GStreamer 1.22.8",
                  "product_id": "T034335-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:open_source:gstreamer:1.22.8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "GStreamer"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T027843",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-50186",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in GStreamer. Dieser Fehler besteht in der AV1-Codec-Parser-Komponente, da die L\u00e4nge der vom Benutzer gelieferten Daten nicht richtig \u00fcberpr\u00fcft wird. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Code auszuf\u00fchren. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034335",
          "T002207",
          "67646",
          "T027843"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-50186"
    }
  ]
}

cve-2023-50186

Vulnerability from cvelistv5

Published

2024-05-03 02:14

Modified

2024-08-02 22:09

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of metadata within AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22300.

References

▼	URL	Tags
	https://www.zerodayinitiative.com/advisories/ZDI-24-368/	x_research-advisory
	https://gstreamer.freedesktop.org/security/sa-2023-0011.html	vendor-advisory

Impacted products

Vendor

Product

Version

▼

GStreamer

Version: bd4a9fde89e2549887e8a77d22ab027bed70d743

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:gstreamer_project:gstreamer:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "gstreamer",
            "vendor": "gstreamer_project",
            "versions": [
              {
                "lessThan": "1.22.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-50186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-24T14:12:22.539239Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-24T14:15:18.560Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:09:49.773Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-24-368",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-368/"
          },
          {
            "name": "vendor-provided URL",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://gstreamer.freedesktop.org/security/sa-2023-0011.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "GStreamer",
          "vendor": "GStreamer",
          "versions": [
            {
              "status": "affected",
              "version": "bd4a9fde89e2549887e8a77d22ab027bed70d743"
            }
          ]
        }
      ],
      "dateAssigned": "2023-12-05T13:37:59.468-06:00",
      "datePublic": "2024-04-19T14:36:32.711-05:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of metadata within AV1 encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22300."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-03T02:14:13.976Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-24-368",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-368/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2023-0011.html"
        }
      ],
      "source": {
        "lang": "en",
        "value": "MICHAEL RANDRIANANTENAINA [https://elkamika.blogspot.com/]"
      },
      "title": "GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2023-50186",
    "datePublished": "2024-05-03T02:14:13.976Z",
    "dateReserved": "2023-12-05T16:15:17.537Z",
    "dateUpdated": "2024-08-02T22:09:49.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted