VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via a crafted Cinepak file that triggers an out-of-bounds array access and memory corruption.

Several vulnerabilities have been discovered in vlc, a multimedia player and streamer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1768     Drew Yao discovered that multiple integer overflows in     the MP4 demuxer, Real demuxer and Cinepak codec can lead     to the execution of arbitrary code.

  - CVE-2008-1769     Drew Yao discovered that the Cinepak codec is prone to a     memory corruption, which can be triggered by a crafted     Cinepak file.

  - CVE-2008-1881     Luigi Auriemma discovered that it is possible to execute     arbitrary code via a long subtitle in an SSA file.

  - CVE-2008-2147     It was discovered that vlc is prone to a search path     vulnerability, which allows local users to perform     privilege escalations.

  - CVE-2008-2430     Alin Rad Pop discovered that it is possible to execute     arbitrary code when opening a WAV file containing a     large fmt chunk.

  - CVE-2008-3794     Pinar Yanardag discovered that it is possible to     execute arbitrary code when opening a crafted mmst link.

  - CVE-2008-4686     Tobias Klein discovered that it is possible to execute     arbitrary code when opening a crafted .ty file.

  - CVE-2008-5032     Tobias Klein discovered that it is possible to execute     arbitrary code when opening an invalid CUE image file     with a crafted header.

The remote host is affected by the vulnerability described in GLSA-200804-25 (VLC: User-assisted execution of arbitrary code)

    Multiple vulnerabilities were found in VLC:
    Luigi Auriemma discovered that the stack-based buffer overflow when     reading subtitles, which has been reported as CVE-2007-6681 in GLSA     200803-13, was not properly fixed (CVE-2008-1881).
    Alin Rad Pop of Secunia reported an array indexing vulnerability in the     sdpplin_parse() function when processing streams from RTSP servers in     Xine code, which is also used in VLC (CVE-2008-0073).
    Drew Yao and Nico Golde reported an integer overflow in the     MP4_ReadBox_rdrf() function in the file libmp4.c leading to a     heap-based buffer overflow when reading MP4 files (CVE-2008-1489).
    Drew Yao also reported integer overflows in the MP4 demuxer,     the Real demuxer and in the Cinepak codec, which might lead to buffer     overflows (CVE-2008-1768).
    Drew Yao finally discovered and a     boundary error in Cinepak, which might lead to memory corruption     (CVE-2008-1769).
  Impact :

    A remote attacker could entice a user to open a specially crafted media     file or stream, possibly resulting in the remote execution of arbitrary     code.
  Workaround :

    There is no known workaround at this time.

The version of VLC Media Player installed on the remote host is reportedly affected by several security issues :

 - A subtitle buffer overflow (CVE-2007-6681).
 - A Real RTSP code execution problem (CVE-2008-0073).
 - MP4 integer overflows (CVE-2008-1489).
 - A cinepak integer overflow.

ID	Name	Product	Family	Severity
39451	Debian DSA-1819-1 : vlc - several vulnerabilities	Nessus	Debian Local Security Checks	high
32045	GLSA-200804-25 : VLC: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
4429	VLC Media Player < 0.8.6f Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2008-1769

high

Tenable Plugins

high

high

high