The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.

The version of VLC media player installed on the remote host is earlier than 2.1.2. As such, it reportedly includes a version of Live Networks' Live555 Streaming Media library earlier than 2013.11.29. A buffer overflow vulnerability in the 'parseRTSPRequestString()' function in that library exists that could lead to a program crash or arbitrary code execution when handling a specially crafted RTSP message.

The remote host is affected by the vulnerability described in GLSA-201411-01 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VLC. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted media       file using VLC, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of VLC media player installed on the remote host is earlier than 2.1.2.  As such, it reportedly includes a version of Live Networks' Live555 Streaming Media library earlier than 2013.11.29.  A buffer overflow vulnerability in the 'parseRTSPRequestString()' function in that library exists that could lead to a program crash or arbitrary code execution when handling a specially crafted RTSP message.

ID	Name	Product	Family	Type	Severity
8651	VLC Media Player 2.x < 2.1.2 Buffer Overflow	Nessus Network Monitor	Web Clients		high
78879	GLSA-201411-01 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
72279	VLC 2.x < 2.1.2 parseRTSPRequestString Function RTSP Command Parsing Overflow	Nessus	Windows	Local	high

Detections

Analytics

CVE-2013-6934

critical

Tenable Plugins

high

high

high