Test ID:	1.3.6.1.4.1.25623.1.0.63496
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1729-1)
Summary:	The remote host is missing an update for the Debian 'gst-plugins-bad0.10' package(s) announced via the DSA-1729-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'gst-plugins-bad0.10' package(s) announced via the DSA-1729-1 advisory. Vulnerability Insight: Several vulnerabilities have been found in gst-plugins-bad0.10, a collection of various GStreamer plugins. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0386 Tobias Klein discovered a buffer overflow in the quicktime stream demuxer (qtdemux), which could potentially lead to the execution of arbitrary code via crafted .mov files. CVE-2009-0387 Tobias Klein discovered an array index error in the quicktime stream demuxer (qtdemux), which could potentially lead to the execution of arbitrary code via crafted .mov files. CVE-2009-0397 Tobias Klein discovered a buffer overflow in the quicktime stream demuxer (qtdemux) similar to the issue reported in CVE-2009-0386, which could also lead to the execution of arbitrary code via crafted .mov files. For the oldstable distribution (etch), these problems have been fixed in version 0.10.3-3.1+etch1. For the stable distribution (lenny), these problems have been fixed in version 0.10.8-4.1~ lenny1 of gst-plugins-good0.10, since the affected plugin has been moved there. The fix was already included in the lenny release. For the unstable distribution (sid) and the testing distribution (squeeze), these problems have been fixed in version 0.10.8-4.1 of gst-plugins-good0.10. Affected Software/OS: 'gst-plugins-bad0.10' package(s) on Debian 4. Solution: Please install the updated package(s). CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0386 BugTraq ID: 33405 http://www.securityfocus.com/bid/33405 Bugtraq: 20090122 [TKADV2009-003] GStreamer Heap Overflow and Array Index out of Bounds Vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/500317/100/0/threaded http://security.gentoo.org/glsa/glsa-200907-11.xml http://www.mandriva.com/security/advisories?name=MDVSA-2009:035 http://trapkit.de/advisories/TKADV2009-003.txt http://www.openwall.com/lists/oss-security/2009/01/29/3 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10306 http://www.redhat.com/support/errata/RHSA-2009-0271.html http://secunia.com/advisories/33650 http://secunia.com/advisories/33815 http://secunia.com/advisories/34336 http://secunia.com/advisories/35777 SuSE Security Announcement: SUSE-SR:2009:005 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html http://www.ubuntu.com/usn/USN-736-1 http://www.vupen.com/english/advisories/2009/0225 Common Vulnerability Exposure (CVE) ID: CVE-2009-0387 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10611 Common Vulnerability Exposure (CVE) ID: CVE-2009-0397 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9942 http://www.redhat.com/support/errata/RHSA-2009-0270.html http://secunia.com/advisories/33830 XForce ISS Database: gstreamer-qtdemuxparse-bo(48555) https://exchange.xforce.ibmcloud.com/vulnerabilities/48555
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.