drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in RTMPDump
Name: |
Mehrere Probleme in RTMPDump |
|
ID: |
201702-02 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Mo, 6. Februar 2017, 06:31 |
|
Referenzen: |
http://www.openwall.com/lists/oss-security/2015/12/30/1 |
|
Applikationen: |
RTMPDump |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --wr6sOCbv60iQnehpCi8QXqJNwgeO92uF3 Content-Type: multipart/mixed; boundary="V6tcs9q6ek0rRmQEq58UC1M0f6W2oNRg8" From: Aaron Bauman <bman@gentoo.org> To: gentoo-announce@lists.gentoo.org Message-ID: <9a88479d-6817-7e1c-f99a-1a32bdc091a4@gentoo.org> Subject: [ GLSA 201702-02 ] RTMPDump: Multiple vulnerabilities
--V6tcs9q6ek0rRmQEq58UC1M0f6W2oNRg8 Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201702-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: RTMPDump: Multiple vulnerabilities Date: February 06, 2017 Bugs: #570242 ID: 201702-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
Multiple vulnerabilities have been found in RTMPDump, the worst of which could lead to arbitrary code execution.
Background ==========
RTMPDump is an RTMP client intended to stream audio or video flash content
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/rtmpdump < 2.4_p20161210 >= 2.4_p20161210
Description ===========
Multiple vulnerabilities have been discovered in RTMPDump.
The following is a list of vulnerabilities fixed:
* Additional decode input size checks * Ignore zero-length packets * Potential integer overflow in RTMPPacket_Alloc(). * Obsolete RTMPPacket_Free() call left over from original C++ to C rewrite * AMFProp_GetObject must make sure the prop is actually an object
Impact ======
A remote attacker could entice a user to open a specially crafted media flash file using RTMPDump. This could possibly result in the execution of arbitrary code with the privileges of the process or a Denial of Service condition.
Workaround ==========
There is no known workaround at this time.
Resolution ==========
All RTMPDump users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=media-video/rtmpdump-2.4_p20161210"
References ==========
[ 1 ] OSS ML CVE Request http://www.openwall.com/lists/oss-security/2015/12/30/1
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/201702-02
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License =======
Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--V6tcs9q6ek0rRmQEq58UC1M0f6W2oNRg8--
--wr6sOCbv60iQnehpCi8QXqJNwgeO92uF3 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2
iQJ8BAEBCgBmBQJYl9s8XxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ1OTcyRDI4NDhFOEE0NDYwRTdERTY4QUM5 RjI4QkQ4QkQxRTM5NUZGAAoJEJ8ovYvR45X/uzoP/iJjc9ukVXD5Y6fpkjbcX6Vu Tt6hLRIOqaQj0Sqg8XwUpmbtxl7sK/Ta5ovvKlKWjKpwDU1DKN2xh1vL155XX5p4 qT3uwZfhmhKqXxszKBZsIUWGGSeAVDmsNL3siwpr2owAOqRqJuLeW3thqWpUhxpA FU+QHqkqup+ZSjZbrAO3+Xj0g7+J0RcJa6rL/hbP0difPKHmHEpJ0DM0vJe9DEHc chl8Gh+2G7VAm1rQrc3bmFottxWmbsRFGjEau0sWr6v5JbDGKUENEGPrAQllJzv5 NbyurpQ9WLcVKfPdI1r9E4zvwfgkmHKwuum2pgjeUY4HLceYickRRyJEKA+wJMOq BrrNWniEvFx7HjCghXVwsbx3idwlkk2kSK3fmZx7/1UbBbNidvvIcJoiegn3DIFA PBZ/45wtv+lWxUwpyJQkdLNBBO9G29BAKQF9wPEOSrKar/EMgnxQenB1wVm0ExO0 qsZTGBwhOdSNoEwojok0BUjnMZGnUMcQfQicLXx/sw0Kxw7lu0sgZv6cc/knmRdX n7xY0BIiSaOINxDpfqfR8hje8bZi++WYUVPPNIbyMZHZCGdr0kbZMAegj7jEqWa9 tG9rC0zgM8aazSeQMM5UysUX928kW5SC0yVJIdT0qH6+HTg/RMIHgFFC7nR5NdoA 4KvS8QWzrFgrFLYqogJ4 =Eu/k -----END PGP SIGNATURE-----
--wr6sOCbv60iQnehpCi8QXqJNwgeO92uF3--
|
|
|
|