VLC Media Player 0.5.0 to 0.9.5 Stack-Based Buffer Overflows

Medium Nessus Network Monitor Plugin ID 4747

Synopsis

The remote Windows host contains an application that is affected by multiple buffer overflow vulnerabilities.

Description

A version of VLC between 0.5.0 and 0.9.5 is installed on the remote host. Such versions are affected by the following vulnerabilities :

- RealText subtitle file (modules\demux\subtitle.c) processing is susceptible to a buffer overflow caused by user-supplied data from a malicious subtitle file being copied into static buffers without proper validation.
- CUE image file (modules\access\vcd\cdrom.c) processing is susceptible to a stack-based buffer overflow because data supplied by the CUE file is supplied as an array index without proper validation.

An attacker may be able to leverage these issues to execute arbitrary code on the remote host by tricking a user into opening a specially crafted video file using the affected application.

Solution

Upgrade to version 0.9.6 or higher.

See Also

http://www.trapkit.de/advisories/TKADV2008-012.txt

http://www.securityfocus.com/archive/1/498111/30/0/threaded

http://www.securityfocus.com/archive/1/498112/30/0/threaded

http://permalink.gmane.org/gmane.comp.security.oss.general/1140

http://www.videolan.org/security/sa0810.html

Plugin Details

Severity: Medium

ID: 4747

Family: Web Clients

Published: 2008/11/12

Modified: 2018/09/16

Dependencies: 1735, 8314

Nessus ID: 34730

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 5.6

Temporal Score: 5.2

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:videolan:vlc_media_player

Exploitable With

Core Impact

Metasploit (VLC Media Player RealText Subtitle Overflow)

Reference Information

CVE: CVE-2008-5032, CVE-2008-5036

BID: 32125, 36403