Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.

Several vulnerabilities have been discovered in vlc, a multimedia player and streamer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1768     Drew Yao discovered that multiple integer overflows in     the MP4 demuxer, Real demuxer and Cinepak codec can lead     to the execution of arbitrary code.

  - CVE-2008-1769     Drew Yao discovered that the Cinepak codec is prone to a     memory corruption, which can be triggered by a crafted     Cinepak file.

  - CVE-2008-1881     Luigi Auriemma discovered that it is possible to execute     arbitrary code via a long subtitle in an SSA file.

  - CVE-2008-2147     It was discovered that vlc is prone to a search path     vulnerability, which allows local users to perform     privilege escalations.

  - CVE-2008-2430     Alin Rad Pop discovered that it is possible to execute     arbitrary code when opening a WAV file containing a     large fmt chunk.

  - CVE-2008-3794     Pinar Yanardag discovered that it is possible to     execute arbitrary code when opening a crafted mmst link.

  - CVE-2008-4686     Tobias Klein discovered that it is possible to execute     arbitrary code when opening a crafted .ty file.

  - CVE-2008-5032     Tobias Klein discovered that it is possible to execute     arbitrary code when opening an invalid CUE image file     with a crafted header.

The remote host is affected by the vulnerability described in GLSA-200807-13 (VLC: Multiple vulnerabilities)

    Remi Denis-Courmont reported that VLC loads plugins from the     current working directory in an unsafe manner (CVE-2008-2147).
    Alin Rad Pop (Secunia Research) reported an integer overflow error     in the Open() function in the file modules/demux/wav.c     (CVE-2008-2430).
  Impact :

    A remote attacker could entice a user to open a specially crafted .wav     file, and a local attacker could entice a user to run VLC from a     directory containing specially crafted modules, possibly resulting in     the execution of arbitrary code with the privileges of the user running     the application.
  Workaround :

    There is no known workaround at this time.

The installed version of VLC media player is affected by an integer overflow vulnerability.  By tricking a user into opening a malicious .WAV file, it may be possible to cause a denial of service condition or execute arbitrary code within the context of the affected application.

The installed version of VLC Media Player is affected by an integer overflow vulnerability.  By tricking a user into opening a malicious .WAV file, it may be possible to cause a denial of service condition or execute arbitrary code within the context of the affected application.

ID	Name	Product	Family	Severity
39451	Debian DSA-1819-1 : vlc - several vulnerabilities	Nessus	Debian Local Security Checks	high
33779	GLSA-200807-13 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
33485	VLC Media Player < 0.8.6i WAV File Handling Integer Overflow	Nessus	Windows	high
4569	VLC Media Player < 0.8.6i WAV File Handling Remote Integer Overflow (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2008-2430

high

Tenable Plugins

high

high

high

medium