Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
Database
Search
Advisories by Product
Advisories by Vendor
Terminology
Report Vulnerability
Insecure Library Loading
Highly critical

VLC Media Player Multiple Buffer Overflow Vulnerabilities

-

Release Date:  2009-09-17    Last Update:  2009-09-23    Views:  12,562

Secunia Advisory SA36762

Where:

From remote

Impact:

System access

Solution Status:

Vendor Patch

CVE Reference(s):

No CVE references.

Description


Some vulnerabilities have been reported in VLC Media Player, which can be exploited by malicious people to potentially compromise a user's system.

1) A boundary error exists within the "ASF_ObjectDumpDebug()" function in modules/demux/asf/libasf.c. This can be exploited to cause a stack-based buffer overflow via a specially crafted ASF file.

2) A boundary error exists within the "AVI_ChunkDumpDebug_level()" function in modules/demux/avi/libavi.c. This can be exploited to cause a stack-based buffer overflow via a specially crafted AVI file.

3) A boundary error exists within the "__MP4_BoxDumpStructure()" function in modules/demux/mp4/libmp4.c. This can be exploited to cause a stack-based buffer overflow via a specially crafted MP4 file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Vulnerability #2 is confirmed in version 1.0.1. Other versions may also be affected.


Solution:
Update to version 1.0.2.

Provided and/or discovered by:
The vendor credits Sebastian Apelt of Siberas.

Original Advisory:
http://www.videolan.org/security/sa0901.html

http://git.videolan.org/?p=vlc.git;a=commit;h=dfe7084e8cc64e9b7a87cd37065b59cba2064823
http://git.videolan.org/?p=vlc.git;a=commit;h=861e374d03e6c60c7d3c98428c632fe3b9e371b2
http://git.videolan.org/?p=vlc.git;a=commit;h=c5b02d011b8c634d041167f4d2936b55eca4d18d

Deep Links:
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: VLC Media Player Multiple Buffer Overflow Vulnerabilities

User Message
[+]

earthsound

RE: VLC Media Player Multiple Buffer Overflow Vulnerabilities
This reply has been minimised due to a negative Relevancy Score.

Sid23

RE: VLC Media Player Multiple Buffer Overflow Vulnerabilities
[+]
This reply has been minimised due to a negative Relevancy Score.
Anthony Wells RE: VLC Media Player Multiple Buffer Overflow Vulnerabilities
Expert Contributor 15th Jun, 2010 17:36
Score: 2384
Posts: 3,280
User Since: 19th Dec 2007
System Score: N/A
Location: N/A

@Sid23 ,

As a new poster on the Community Forum , let me advise you that you are posting in a "sub-forum" reserved for technical commentary on a specific Secunia Advisory .

Your comments relate to your specific concerns about your program and it's display by PSI and are not relevant as such to SA 36762 .

If you still require help , I would suggest you repost your questions by "creating" a new thread in either the "Program" or "PSI" sub-forum (see the column on the left hand side of this "Community" webpage).

Take care
Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+11
-0

-

You must be logged in to post a comment.



 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability