VLC Media Player Heap Overflow in MMS Protocol Handling Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1020759
|
|
SecurityTracker URL: http://securitytracker.com/id?1020759
|
|
CVE Reference: CVE-2008-3794
(Links to External Site)
|
Date: Aug 27 2008
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 0.8.6i and prior versions
|
Description: A vulnerability was reported in VLC Media Player. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted MMS stream that, when loaded by the target user via a 'mmst://' URL, will trigger a
heap overflow and execute arbitrary code on the target system. The code will run with the privileges of the target user.
The
vulnerability resides in the mms_ReceiveCommand() function in 'modules\access\mms\mmstu.c'.
Orange Bat reported this vulnerability.
The
original advisory is available at:
http://www.orange-bat.com/adv/2008/adv.08.24.txt
|
Impact: A remote user can create a stream that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution: The vendor has issued a source code fix, available at:
http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=afe3464a1c7c6f9d7640a3f5db17010c34212440
|
Vendor URL: www.videolan.org/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
Reported By: Nico Golde <oss-security+ml@nohost.nodomain>
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 24 Aug 2008 02:13:24 +0200
From: Nico Golde <oss-security+ml@nohost.nodomain>
Subject: CVE id request: vlc
|
Hi,
there seems to be a buffer overflow in videolans mms
handling:
http://www.orange-bat.com/adv/2008/adv.08.24.txt
Can I get a CVE id for this?
Cheers
Nico
--
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
|
|
