Denial of Service Vulnerability in GStreamer gst-plugins-base1 Package
Summary
ALPINE-CVE-2017-5844: The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a cra... Affects gst-plugins-base1 versions < 1.8.3-r0. Fixed in 1.8.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful multimedia framework that allows the construction of graphs of media-handling components. The gst-plugins-base1 package is a core component of GStreamer, providing essential plugins for handling various media formats. This package is widely used in applications that require audio and video processing. However, it has been found to be vulnerable to a denial of service attack due to improper handling of crafted ASF files.
Vulnerability Detail
The vulnerability arises from the function gst_riff_create_audio_caps in the gst-plugins-base1 package, which is part of the GStreamer framework. This function fails to properly validate input from crafted ASF files, allowing remote attackers to trigger a floating point exception, leading to a crash of the application. The vulnerability has been assigned the identifier CVE-2017-5844 and has a CVSS score of 5.5, indicating a moderate severity level. If exploited, this vulnerability can disrupt services and affect the availability of applications relying on GStreamer.
How To Fix
Minimum fixed version
1.8.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade gst-plugins-base1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid processing untrusted ASF files until the package is updated. This can be done by implementing input validation checks in the application to ensure that only safe and verified media files are processed.
Conclusion
The CVE-2017-5844 vulnerability in the GStreamer gst-plugins-base1 package poses a risk of denial of service through crafted ASF files. Users are urged to update their packages to the fixed version to ensure the security and stability of their applications.
See every vulnerability recorded for gst-plugins-base1 →
FAQ
CVE-2017-5844 is a vulnerability in the GStreamer gst-plugins-base1 package that allows remote attackers to cause a denial of service via crafted ASF files.
The vulnerability can lead to application crashes, resulting in service disruptions for users relying on GStreamer for media processing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
It is recommended to update the gst-plugins-base1 package to version 1.8.3-r0 or later to mitigate the vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for gst-plugins-base1.
