Critical Heap-Based Buffer Overflow in GStreamer RTSP Parser - gst-plugins-base
Summary
ALPINE-CVE-2019-9928: GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution. Affects gst-plugins-base versions < 1.16.0-r0. Fixed in 1.16.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful multimedia framework that allows the construction of graphs of media-handling components. The gst-plugins-base package provides a set of essential plugins for GStreamer, enabling various media formats and protocols. This package is widely used in applications that require audio and video processing. However, a critical vulnerability has been identified in versions prior to 1.16.0, which could potentially allow remote code execution through crafted RTSP responses.
Vulnerability Detail
The vulnerability arises from a heap-based buffer overflow in the RTSP connection parser of GStreamer. When the parser processes a crafted response from a server, it can lead to memory corruption, allowing an attacker to execute arbitrary code on the affected system. This vulnerability is particularly severe, with a CVSS score of 8.8, indicating a high risk of exploitation. Attackers can leverage this flaw to gain unauthorized access and control over the system running the vulnerable version of the package.
How To Fix
Minimum fixed version
1.16.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade gst-plugins-baseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network-level protections, such as firewalls or intrusion detection systems, to mitigate the risk of exploitation. Additionally, avoid using untrusted RTSP servers until the package is updated.
Conclusion
The identified vulnerability in the GStreamer RTSP parser poses a significant risk to systems using the gst-plugins-base package. It is crucial to update to the patched version to mitigate potential exploitation. Users should remain vigilant and consider additional security measures if immediate updates are not possible.
See every vulnerability recorded for gst-plugins-base →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
All versions of gst-plugins-base prior to 1.16.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider implementing network-level protections and avoid using untrusted RTSP servers.
More information can be found in the CVE details and the Alpine Linux security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for gst-plugins-base.
