A stack overflow was found and reported by Stefan Cornelius of Secunia Research in the code used to handle cddb queries. Two other similar issues were found by Reimar Döffinger while fixing the issue. The vulnerability is identified with CVE-2007-2948 and SAID 24302. When copying the album title and category, no checking was performed on the size of the strings before storing them in a fixed-size array. A malicious entry in the database could trigger a stack overflow in the program, leading to arbitrary code execution with the uid of the user running MPlayer.

Severity

High (arbitrary remote code execution under the user ID running the player) when getting disk information from a malicious cddb entry, null if you do not use this feature. Please note that it is possible to overwrite entries in the cddb database, so an attack can also be performed via a non-compromised server. At the time the buffer overflow was fixed there was no known exploit in the wild.

Solution

A fix for this problem was committed to SVN on Tue Jun 5 11:13:32 2007 UTC as r23470. Users of affected MPlayer versions should download a patch for MPlayer 1.0rc1 or update to the latest version if they're using SVN.