Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via a long subtitle in a (1) MicroDvd, (2) SSA, and (3) Vplayer file.

The remote host is affected by the vulnerability described in GLSA-200804-25 (VLC: User-assisted execution of arbitrary code)

    Multiple vulnerabilities were found in VLC:
    Luigi Auriemma discovered that the stack-based buffer overflow when     reading subtitles, which has been reported as CVE-2007-6681 in GLSA     200803-13, was not properly fixed (CVE-2008-1881).
    Alin Rad Pop of Secunia reported an array indexing vulnerability in the     sdpplin_parse() function when processing streams from RTSP servers in     Xine code, which is also used in VLC (CVE-2008-0073).
    Drew Yao and Nico Golde reported an integer overflow in the     MP4_ReadBox_rdrf() function in the file libmp4.c leading to a     heap-based buffer overflow when reading MP4 files (CVE-2008-1489).
    Drew Yao also reported integer overflows in the MP4 demuxer,     the Real demuxer and in the Cinepak codec, which might lead to buffer     overflows (CVE-2008-1768).
    Drew Yao finally discovered and a     boundary error in Cinepak, which might lead to memory corruption     (CVE-2008-1769).
  Impact :

    A remote attacker could entice a user to open a specially crafted media     file or stream, possibly resulting in the remote execution of arbitrary     code.
  Workaround :

    There is no known workaround at this time.

Luigi Auriemma, Alin Rad Pop, Remi Denis-Courmont, Quovodis, Guido Landi, Felipe Manzano, Anibal Sacco and others discovered multiple vulnerabilities in vlc, an application for playback and streaming of audio and video. In the worst case, these weaknesses permit a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user running vlc.

The Common Vulnerabilities and Exposures project identifies the following eight problems :

  - CVE-2007-6681     A buffer overflow vulnerability in subtitle handling     allows an attacker to execute arbitrary code through the     opening of a maliciously crafted MicroDVD, SSA or     Vplayer file.

  - CVE-2007-6682     A format string vulnerability in the HTTP-based remote     control facility of the vlc application allows a remote,     unauthenticated attacker to execute arbitrary code.

  - CVE-2007-6683     Insecure argument validation allows a remote attacker to     overwrite arbitrary files writable by the user running     vlc, if a maliciously crafted M3U playlist or MP3 audio     file is opened.

  - CVE-2008-0295, CVE-2008-0296     Heap buffer overflows in RTSP stream and session     description protocol (SDP) handling allow an attacker to     execute arbitrary code if a maliciously crafted RTSP     stream is played.

  - CVE-2008-0073     Insufficient integer bounds checking in SDP handling     allows the execution of arbitrary code through a     maliciously crafted SDP stream ID parameter in an RTSP     stream.

  - CVE-2008-0984     Insufficient integrity checking in the MP4 demuxer     allows a remote attacker to overwrite arbitrary memory     and execute arbitrary code if a maliciously crafted MP4     file is opened.

  - CVE-2008-1489     An integer overflow vulnerability in MP4 handling allows     a remote attacker to cause a heap buffer overflow,     inducing a crash and possibly the execution of arbitrary     code if a maliciously crafted MP4 file is opened.

The version of VLC Media Player installed on the remote host reportedly is affected by several security issues :

  - A subtitle buffer overflow (CVE-2007-6681).

  - A Real RTSP code execution problem (CVE-2008-0073).

  - MP4 integer overflows (CVE-2008-1489).

  - A cinepak integer overflow.

The version of VLC Media Player installed on the remote host is reportedly affected by several security issues :

 - A subtitle buffer overflow (CVE-2007-6681).
 - A Real RTSP code execution problem (CVE-2008-0073).
 - MP4 integer overflows (CVE-2008-1489).
 - A cinepak integer overflow.

The remote host is affected by the vulnerability described in GLSA-200803-13 (VLC: Multiple vulnerabilities)

    Multiple vulnerabilities were found in VLC:
    Michal Luczaj     and Luigi Auriemma reported that VLC contains boundary errors when     handling subtitles in the ParseMicroDvd(), ParseSSA(), and     ParseVplayer() functions in the modules/demux/subtitle.c file, allowing     for a stack-based buffer overflow (CVE-2007-6681).
    The web     interface listening on port 8080/tcp contains a format string error in     the httpd_FileCallBack() function in the network/httpd.c file     (CVE-2007-6682).
    The browser plugin possibly contains an     argument injection vulnerability (CVE-2007-6683).
    The RSTP     module triggers a NULL pointer dereference when processing a request     without a 'Transport' parameter (CVE-2007-6684).
    Luigi     Auriemma and Remi Denis-Courmont found a boundary error in the     modules/access/rtsp/real_sdpplin.c file when processing SDP data for     RTSP sessions (CVE-2008-0295) and a vulnerability in the     libaccess_realrtsp plugin (CVE-2008-0296), possibly resulting in a     heap-based buffer overflow.
    Felipe Manzano and Anibal Sacco     (Core Security Technologies) discovered an arbitrary memory overwrite     vulnerability in VLC's MPEG-4 file format parser (CVE-2008-0984).
  Impact :

    A remote attacker could send a long subtitle in a file that a user is     enticed to open, a specially crafted MP4 input file, long SDP data, or     a specially crafted HTTP request with a 'Connection' header value     containing format specifiers, possibly resulting in the remote     execution of arbitrary code. Also, a Denial of Service could be caused     and arbitrary files could be overwritten via the 'demuxdump-file'     option in a filename in a playlist or via an EXTVLCOPT statement in an     MP3 file.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
32045	GLSA-200804-25 : VLC: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
31949	Debian DSA-1543-1 : vlc - several vulnerabilities	Nessus	Debian Local Security Checks	critical
31853	VLC Media Player < 0.8.6f Multiple Vulnerabilities	Nessus	Windows	high
4429	VLC Media Player < 0.8.6f Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	high
31439	GLSA-200803-13 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2007-6681

critical

Tenable Plugins

high

critical

high

high

critical