Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[ GLSA 200803-13 ] VLC: Multiple vulnerabilities
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
GLSA
Veteran
Veteran


Joined: 12 May 2004
Posts: 1582

PostPosted: Fri Mar 07, 2008 11:26 pm    Post subject: [ GLSA 200803-13 ] VLC: Multiple vulnerabilities Reply with quote

Gentoo Linux Security Advisory

Title: VLC: Multiple vulnerabilities (GLSA 200803-13)
Severity: high
Exploitable: remote
Date: March 07, 2008
Bug(s): #203345, #211575, #205299
ID: 200803-13

Synopsis


Multiple vulnerabilities were found in VLC, allowing for the execution of
arbitrary code and Denial of Service.


Background


VLC is a cross-platform media player and streaming server.


Affected Packages

Package: media-video/vlc
Vulnerable: < 0.8.6e
Unaffected: >= 0.8.6e
Architectures: All supported architectures


Description


Multiple vulnerabilities were found in VLC:
  • Michal Luczaj
    and Luigi Auriemma reported that VLC contains boundary errors when
    handling subtitles in the ParseMicroDvd(), ParseSSA(), and
    ParseVplayer() functions in the modules/demux/subtitle.c file, allowing
    for a stack-based buffer overflow (CVE-2007-6681).
  • The web
    interface listening on port 8080/tcp contains a format string error in
    the httpd_FileCallBack() function in the network/httpd.c file
    (CVE-2007-6682).
  • The browser plugin possibly contains an
    argument injection vulnerability (CVE-2007-6683).
  • The RSTP
    module triggers a NULL pointer dereference when processing a request
    without a "Transport" parameter (CVE-2007-6684).
  • Luigi
    Auriemma and Remi Denis-Courmont found a boundary error in the
    modules/access/rtsp/real_sdpplin.c file when processing SDP data for
    RTSP sessions (CVE-2008-0295) and a vulnerability in the
    libaccess_realrtsp plugin (CVE-2008-0296), possibly resulting in a
    heap-based buffer overflow.
  • Felipe Manzano and Anibal Sacco
    (Core Security Technologies) discovered an arbitrary memory overwrite
    vulnerability in VLC's MPEG-4 file format parser (CVE-2008-0984).


Impact


A remote attacker could send a long subtitle in a file that a user is
enticed to open, a specially crafted MP4 input file, long SDP data, or
a specially crafted HTTP request with a "Connection" header value
containing format specifiers, possibly resulting in the remote
execution of arbitrary code. Also, a Denial of Service could be caused
and arbitrary files could be overwritten via the "demuxdump-file"
option in a filename in a playlist or via an EXTVLCOPT statement in an
MP3 file.


Workaround


There is no known workaround at this time.


Resolution


All VLC users should upgrade to the latest version:
Code:
# emerge --sync
    # emerge --ask --oneshot --verbose ">=media-video/vlc-0.8.6e"


References

CVE-2007-6681
CVE-2007-6682
CVE-2007-6683
CVE-2007-6684
CVE-2008-0295
CVE-2008-0296
CVE-2008-0984


Last edited by GLSA on Sat Nov 22, 2014 4:27 am; edited 2 times in total
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum