Synopsis :

The remote Windows host contains a media player that is affected by
multiple vulnerabilities.

Description :

The version of VLC media player installed on the remote host is earlier
than 2.0.5. It is, therefore, reportedly affected by the following
vulnerabilities :

- An error exists in the file 'modules/codec/subsdec.c'
('libsubsdec_plugin.dll') that does not properly
validate input and can allow a buffer overflow. Opening
a specially crafted file can result in the execution of
arbitrary code. Note that the subtitles feature must be
enabled for successful exploitation.

- An error exists related to the 'freetype' renderer that
does not properly validate input and can allow a buffer
overflow. Opening a specially crafted file can result in
the execution of arbitrary code.

- Unspecified errors exist related to 'libaiff_plugin.dll'
and to the 'SWF' demuxer that have unspecified impact.

See also :

http://securitytracker.com/id/1027929
http://www.videolan.org/security/sa1301.html
http://www.nessus.org/u?4cd2e15e
http://www.videolan.org/vlc/releases/2.0.5.html

Solution :

Upgrade to VLC version 2.0.5 or later. Alternatively, remove any
affected plugin files from VLC's plugins directory.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.9
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false