tixxDZ has reported a vulnerability in VLC Media Player, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to an integer underflow error within the "real_get_rdt_chunk()" function in modules/access/rtsp/real.c. This can be exploited to potentially cause a heap-based buffer overflow via a specially crafted RTSP stream.

Successful exploitation may allow execution of arbitrary code, but requires that the application is running on a system which implements "read()" or "recv()" functions accepting negative arguments (e.g. not Windows XP or Linux 2.6.x).

The vulnerability is reported in version 1.0.0. Other versions may also be affected.

Solution
Update to version 1.0.1.

Provided and/or discovered by
tixxDZ, DZCORE Labs

Changelog
Further details available in Customer Area

Original Advisory
tixxDZ:
http://archives.neohapsis.com/archives/bugtraq/2009-07/0198.html

VLC:
http://wiki.videolan.org/Changelog/1.0.1#Access

Deep Links
Links available in Customer Area