CVE-2023-40475
published 2024-05-03CVE-2023-40475: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on…
PriorityP258high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.87%
76.7th percentile
GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of MXF video files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21661.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gst-plugins-bad1.0 | < gst-plugins-bad1.0 1.22.0-4+deb12u2 (bookworm) | gst-plugins-bad1.0 1.22.0-4+deb12u2 (bookworm) |
| gstreamer | gstreamer | < 1.22.6 | 1.22.6 |
| gstreamer | gstreamer | — | — |
| ubuntu | gst-plugins-bad1.0 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for parsing of MXF video files with malformed AES3 audio data triggering an integer overflow before buffer allocation in GStreamer's MXF demuxer (gstreamer-plugins-bad) ↗
- →Monitor for heap buffer overflow conditions in GStreamer Plugins Bad when processing MXF files containing AES3 audio streams, which may indicate exploitation attempts ↗
- →Flag delivery or opening of MXF files from untrusted/remote sources in environments using GStreamer, as the attack vector involves remote attackers supplying malicious MXF files ↗
- ·Fixed versions are available; unpatched GStreamer Plugins Bad installations remain vulnerable. Patch to the following versions to remediate. ↗
- ·Red Hat rates this as Moderate impact due to the requirement for local authenticated user interaction with the library; RHEL 6 and 7 packages are out of support scope and will not receive fixes. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-40475: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability
osv·2024-05-03·CVSS 8.8
CVE-2023-40475 [HIGH] CVE-2023-40475: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability
GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-21661.
GHSA
GHSA-r6qp-3cmm-v7xj: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability
ghsa_unreviewed·2024-05-03
CVE-2023-40475 [HIGH] CWE-190 GHSA-r6qp-3cmm-v7xj: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability
GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of MXF video files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21661.
Ubuntu
GStreamer Bad Plugins vulnerabilities
vendor_ubuntu·2026-04-23·CVSS 8.8
CVE-2023-40475 [HIGH] GStreamer Bad Plugins vulnerabilities
Title: GStreamer Bad Plugins vulnerabilities
Summary: Several security issues were fixed in GStreamer Bad Plugins.
It was discovered that multiple plugins in GStreamer contained arithmetic
overflows. An attacker could possibly use this issue to cause applications
using the plugins to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2023-37329, CVE-2023-40474, CVE-2023-40475,
CVE-2023-40476)
It was discovered that the MXF demuxer plugin in GStreamer did not
properly manage memory. An attacker could possibly use this issue to cause
applications using the plugin to crash, resulting in a denial of service,
or possibly execute arbitrary code. (CVE-2023-44446)
It was discovered that the H265 codec plugin in GStreamer could be made
to write out of bounds. An a
Ubuntu
GStreamer Bad Plugins vulnerabilities
vendor_ubuntu·2023-11-29
CVE-2023-40476 GStreamer Bad Plugins vulnerabilities
Title: GStreamer Bad Plugins vulnerabilities
Summary: Several security issues were fixed in GStreamer Bad Plugins.
It was discovered that GStreamer Bad Plugins incorrectly handled certain
media files. A remote attacker could use this issue to cause GStreamer
Bad Plugins to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio
vendor_redhat·2023-09-20·CVSS 8.8
CVE-2023-40475 [HIGH] CWE-190 gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio
gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio
GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of MXF video files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21661.
A heap buffer overflow flaw was found in the
Debian
CVE-2023-40475: gst-plugins-bad1.0 - GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability....
vendor_debian·2023·CVSS 8.8
CVE-2023-40475 [HIGH] CVE-2023-40475: gst-plugins-bad1.0 - GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability....
GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-21661.
Scope: local
bookworm: resolved (fixed in 1.22.0-4+deb12u2)
bullseye: resolved (fixed in 1.18.4-3+deb11u2)
forky: resolved (fixed in 1.22.7-1)
sid: r
Suricata
ET EXPLOIT Totolink Command Injection Attempt (CVE-2020-40475)
suricata·2023-11-08
CVE-2020-40475 ET EXPLOIT Totolink Command Injection Attempt (CVE-2020-40475)
ET EXPLOIT Totolink Command Injection Attempt (CVE-2020-40475)
Rule: alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Totolink Command Injection Attempt (CVE-2020-40475)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/downloadFile.cgi?payload="; fast_pattern; content:"|60|"; distance:0; reference:url,www.fortinet.com/blog/threat-research/Iz1h9-campaign-enhances-arsenal-with-scores-of-exploits; reference:cve,2020-40475; classtype:attempted-admin; sid:2049121; rev:2; metadata:attack_target Networking_Equipment, created_at 2023_11_08, cve CVE_2020_40475, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2024_05_22, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_techni
No public exploits indexed.
No writeups or analysis indexed.
https://gstreamer.freedesktop.org/security/sa-2023-0007.htmlhttps://www.zerodayinitiative.com/advisories/ZDI-23-1457/https://gstreamer.freedesktop.org/security/sa-2023-0007.htmlhttps://lists.debian.org/debian-lts-announce/2023/10/msg00038.htmlhttps://www.zerodayinitiative.com/advisories/ZDI-23-1457/
2024-05-03
Published