VLC Media Player < 2.2.5 Multiple Vulnerabilities

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

A media player installed on the remote host is affected by multiple
vulnerabilities.

Description :

The version of VLC media player installed on the remote host is prior
to 2.2.5. It is, therefore, affected by the multiple vulnerabilities :

- A denial of service vulnerability exists within file
plugins\audio_filter\libmpgatofixed32_plugin.dll when
parsing media files due to improper validation of
user-supplied input. An unauthenticated, remote attacker
can exploit this, via a specially crafted file, to crash
the application. (CVE-2017-9301)

- A flaw exists, related to a ParseJSS null skip, when
handling specially crafted subtitle files downloaded by
the media player. An unauthenticated, remote attacker
can exploit this, via a specially crafted file, to
execute arbitrary code. (VulnDB 158145)

- A heap-based buffer overflow condition exists due to
improper validation of user-supplied input. An
unauthenticated, remote attacker can exploit this, via a
specially crafted AVI file, to execute arbitrary code.
(VulnDB 158159)

- A memory corruption issue exists when handling LPCM in
VOB files. An unauthenticated, remote attacker can
exploit this, via a specially crafted file, to execute
arbitrary code. (VulnDB 158214)

See also :

http://www.videolan.org/developers/vlc-branch/NEWS
http://www.videolan.org/vlc/releases/2.2.5.html
https://trac.videolan.org/vlc/ticket/17448
http://fortiguard.com/zeroday/FG-VD-16-067
http://fortiguard.com/zeroday/FG-VD-16-090
http://www.nessus.org/u?472b5bc4

Solution :

Upgrade to VLC version 2.2.5 or later.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.3
(CVSS2#E:POC/RL:OF/RC:ND)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 100592 ()

Bugtraq ID: 98746

CVE ID: CVE-2017-9301

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now