Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via format string specifiers in the Connection parameter.

Luigi Auriemma, Alin Rad Pop, Remi Denis-Courmont, Quovodis, Guido Landi, Felipe Manzano, Anibal Sacco and others discovered multiple vulnerabilities in vlc, an application for playback and streaming of audio and video. In the worst case, these weaknesses permit a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user running vlc.

The Common Vulnerabilities and Exposures project identifies the following eight problems :

  - CVE-2007-6681     A buffer overflow vulnerability in subtitle handling     allows an attacker to execute arbitrary code through the     opening of a maliciously crafted MicroDVD, SSA or     Vplayer file.

  - CVE-2007-6682     A format string vulnerability in the HTTP-based remote     control facility of the vlc application allows a remote,     unauthenticated attacker to execute arbitrary code.

  - CVE-2007-6683     Insecure argument validation allows a remote attacker to     overwrite arbitrary files writable by the user running     vlc, if a maliciously crafted M3U playlist or MP3 audio     file is opened.

  - CVE-2008-0295, CVE-2008-0296     Heap buffer overflows in RTSP stream and session     description protocol (SDP) handling allow an attacker to     execute arbitrary code if a maliciously crafted RTSP     stream is played.

  - CVE-2008-0073     Insufficient integer bounds checking in SDP handling     allows the execution of arbitrary code through a     maliciously crafted SDP stream ID parameter in an RTSP     stream.

  - CVE-2008-0984     Insufficient integrity checking in the MP4 demuxer     allows a remote attacker to overwrite arbitrary memory     and execute arbitrary code if a maliciously crafted MP4     file is opened.

  - CVE-2008-1489     An integer overflow vulnerability in MP4 handling allows     a remote attacker to cause a heap buffer overflow,     inducing a crash and possibly the execution of arbitrary     code if a maliciously crafted MP4 file is opened.

The remote host is running VLC, a popular media player application which can have an embedded web server. 

The remote version of this software is vulnerable to a format string attack when processing a malformed 'Connection:' http header. 

An attacker can exploit this flaw to execute arbitrary commands with the privileges of the VLC application.

The version of VLC Media Player installed on the remote host is reportedly affected by several security issues :

 - A subtitle buffer overflow (CVE-2007-6681).
 - A Real RTSP code execution problem (CVE-2008-0073).
 - MP4 integer overflows (CVE-2008-1489).
 - A cinepak integer overflow.

The remote host is affected by the vulnerability described in GLSA-200803-13 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities were found in VLC:
    Michal Luczaj     and Luigi Auriemma reported that VLC contains boundary errors when     handling subtitles in the ParseMicroDvd(), ParseSSA(), and     ParseVplayer() functions in the modules/demux/subtitle.c file, allowing     for a stack-based buffer overflow (CVE-2007-6681).
    The web     interface listening on port 8080/tcp contains a format string error in     the httpd_FileCallBack() function in the network/httpd.c file     (CVE-2007-6682).
    The browser plugin possibly contains an     argument injection vulnerability (CVE-2007-6683).
    The RSTP     module triggers a NULL pointer dereference when processing a request     without a 'Transport' parameter (CVE-2007-6684).
    Luigi     Auriemma and Remi Denis-Courmont found a boundary error in the     modules/access/rtsp/real_sdpplin.c file when processing SDP data for     RTSP sessions (CVE-2008-0295) and a vulnerability in the     libaccess_realrtsp plugin (CVE-2008-0296), possibly resulting in a     heap-based buffer overflow.
    Felipe Manzano and Anibal Sacco     (Core Security Technologies) discovered an arbitrary memory overwrite     vulnerability in VLC's MPEG-4 file format parser (CVE-2008-0984).
  Impact :

    A remote attacker could send a long subtitle in a file that a user is     enticed to open, a specially crafted MP4 input file, long SDP data, or     a specially crafted HTTP request with a 'Connection' header value     containing format specifiers, possibly resulting in the remote     execution of arbitrary code. Also, a Denial of Service could be caused     and arbitrary files could be overwritten via the 'demuxdump-file'     option in a filename in a playlist or via an EXTVLCOPT statement in an     MP3 file.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
31949	Debian DSA-1543-1 : vlc - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
31642	VLC Media Player network/httpd.c httpd_FileCallBack Function Connection Parameter Format String	Nessus	Gain a shell remotely	Remote	high
4429	VLC Media Player < 0.8.6f Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients		high
31439	GLSA-200803-13 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical

Detections

Analytics

CVE-2007-6682

critical

Tenable Plugins

critical

high

high

critical