Bug 13235

Summary:	libmms new security issue CVE-2014-2892
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	rverschelde, shlomif, sysadmin-bugs, tmb
Version:	4	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/595998/
Whiteboard:	MGA3TOO has_procedure advisory MGA4-64-OK MGA4-32-OK MGA3-64-OK MGA3-32-OK
Source RPM:	libmms-0.6.2-4.mga4.src.rpm	CVE:
Status comment:

Description David Walser 2014-04-18 22:53:35 CEST

A CVE has been assigned for a security issue fixed upstream in libmms:
http://openwall.com/lists/oss-security/2014/04/18/14

The issue was fixed in 0.6.4, and the commit to fix it is linked in the message above.

Mageia 3 and Mageia 4 are also affected.

Reproducible: 

Steps to Reproduce:

David Walser 2014-04-18 22:53:44 CEST

Whiteboard: (none) => MGA4TOO, MGA3TOO

Comment 1 David Walser 2014-04-21 22:39:43 CEST

Updated package uploaded for Cauldron.

Patched packages uploaded for Mageia 3 and Mageia 4.

Advisory:
========================

Updated libmms packages fix security vulnerability:

The libmms library before 0.6.4 is vulnerable to a buffer overflow in
get_answer() in src/mmsh.c.  It may be triggered via an overly long line of
a MMSH (MMS over HTTP) server response, effectively overflowing the buffer
which has a static size (CVE-2014-2892).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2892
http://openwall.com/lists/oss-security/2014/04/18/14
========================

Updated packages in core/updates_testing:
========================
libmms0-0.6.2-3.1.mga3
libmms-devel-0.6.2-3.1.mga3
libmms0-0.6.2-4.1.mga4
libmms-devel-0.6.2-4.1.mga4

from SRPMS:
libmms-0.6.2-3.1.mga3.src.rpm
libmms-0.6.2-4.1.mga4.src.rpm

Version: Cauldron => 4
Assignee: bugsquad => qa-bugs
Whiteboard: MGA4TOO, MGA3TOO => MGA3TOO

Comment 2 Shlomi Fish 2014-04-23 11:07:25 CEST

Here is the procedure / has_procedure I used (tested OK on mga4-64-OK ):

1. Install lib64mms0 from the updates.

2. Install gst123 , gstreamer1.0-mms , and gstreamer1.0-plugins-ugly.

3. From the command line run:

    gst123 'mms://media.internet.fo/uf16'

4. Make sure it plays fine.

5. I checked that libmms is used by it using Â«cat /proc/`pgrep gst123/mapsÂ» .

Best regards,

-- Shlomi Fish

CC: (none) => shlomif
Whiteboard: MGA3TOO => MGA3TOO MGA4-64-OK has_procedure

Comment 3 Shlomi Fish 2014-04-23 11:10:57 CEST

Tested fine on MGA4-32-OK .

Whiteboard: MGA3TOO MGA4-64-OK has_procedure => MGA3TOO MGA4-64-OK MGA4-32-OK has_procedure

Comment 4 Shlomi Fish 2014-04-23 11:21:03 CEST

Tested fine on MGA3-64-OK .

I should note that on MGA3 gst123 uses gstreamer0.10 so the command should be :

    urpmi gst123 gstreamer0.10-mms gstreamer0.10-plugins-ugly

Whiteboard: MGA3TOO MGA4-64-OK MGA4-32-OK has_procedure => MGA3TOO MGA4-64-OK MGA4-32-OK MGA3-64-OK has_procedure

Comment 5 Shlomi Fish 2014-04-23 11:26:13 CEST

Tested fine on MGA3-32-OK .

Whiteboard: MGA3TOO MGA4-64-OK MGA4-32-OK MGA3-64-OK has_procedure => MGA3TOO MGA4-64-OK MGA4-32-OK MGA3-64-OK MGA3-32-OK has_procedure

Comment 6 claire robinson 2014-04-23 15:25:03 CEST

Nice procedure Shlomi, thanks, the cat command is missing a ` though, checked with this..

# cat /proc/`pgrep gst123`/maps
or
# cat /proc/$(pgrep gst123)/maps | grep mms

Whiteboard: MGA3TOO MGA4-64-OK MGA4-32-OK MGA3-64-OK MGA3-32-OK has_procedure => MGA3TOO has_procedure MGA4-64-OK MGA4-32-OK MGA3-64-OK MGA3-32-OK has_procedure

Comment 7 claire robinson 2014-04-23 15:28:45 CEST

Validating. Advisory uploaded.

Could sysadmin please push to 3 & 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO has_procedure MGA4-64-OK MGA4-32-OK MGA3-64-OK MGA3-32-OK has_procedure => MGA3TOO has_procedure advisory MGA4-64-OK MGA4-32-OK MGA3-64-OK MGA3-32-OK has_procedure
CC: (none) => sysadmin-bugs

Rémi Verschelde 2014-04-23 15:33:59 CEST

CC: (none) => remi
Whiteboard: MGA3TOO has_procedure advisory MGA4-64-OK MGA4-32-OK MGA3-64-OK MGA3-32-OK has_procedure => MGA3TOO has_procedure advisory MGA4-64-OK MGA4-32-OK MGA3-64-OK MGA3-32-OK

Comment 8 Thomas Backlund 2014-04-23 18:20:16 CEST

Update pushed:
http://advisories.mageia.org/MGASA-2014-0190.html

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED

David Walser 2014-04-24 19:56:32 CEST

URL: (none) => http://lwn.net/Vulnerabilities/595998/