Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF box that triggers a heap-based buffer overflow, a different vulnerability than CVE-2008-0984.

The remote host is affected by the vulnerability described in GLSA-200804-25 (VLC: User-assisted execution of arbitrary code)

    Multiple vulnerabilities were found in VLC:
    Luigi Auriemma discovered that the stack-based buffer overflow when     reading subtitles, which has been reported as CVE-2007-6681 in GLSA     200803-13, was not properly fixed (CVE-2008-1881).
    Alin Rad Pop of Secunia reported an array indexing vulnerability in the     sdpplin_parse() function when processing streams from RTSP servers in     Xine code, which is also used in VLC (CVE-2008-0073).
    Drew Yao and Nico Golde reported an integer overflow in the     MP4_ReadBox_rdrf() function in the file libmp4.c leading to a     heap-based buffer overflow when reading MP4 files (CVE-2008-1489).
    Drew Yao also reported integer overflows in the MP4 demuxer,     the Real demuxer and in the Cinepak codec, which might lead to buffer     overflows (CVE-2008-1768).
    Drew Yao finally discovered and a     boundary error in Cinepak, which might lead to memory corruption     (CVE-2008-1769).
  Impact :

    A remote attacker could entice a user to open a specially crafted media     file or stream, possibly resulting in the remote execution of arbitrary     code.
  Workaround :

    There is no known workaround at this time.

Luigi Auriemma, Alin Rad Pop, Remi Denis-Courmont, Quovodis, Guido Landi, Felipe Manzano, Anibal Sacco and others discovered multiple vulnerabilities in vlc, an application for playback and streaming of audio and video. In the worst case, these weaknesses permit a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user running vlc.

The Common Vulnerabilities and Exposures project identifies the following eight problems :

  - CVE-2007-6681     A buffer overflow vulnerability in subtitle handling     allows an attacker to execute arbitrary code through the     opening of a maliciously crafted MicroDVD, SSA or     Vplayer file.

  - CVE-2007-6682     A format string vulnerability in the HTTP-based remote     control facility of the vlc application allows a remote,     unauthenticated attacker to execute arbitrary code.

  - CVE-2007-6683     Insecure argument validation allows a remote attacker to     overwrite arbitrary files writable by the user running     vlc, if a maliciously crafted M3U playlist or MP3 audio     file is opened.

  - CVE-2008-0295, CVE-2008-0296     Heap buffer overflows in RTSP stream and session     description protocol (SDP) handling allow an attacker to     execute arbitrary code if a maliciously crafted RTSP     stream is played.

  - CVE-2008-0073     Insufficient integer bounds checking in SDP handling     allows the execution of arbitrary code through a     maliciously crafted SDP stream ID parameter in an RTSP     stream.

  - CVE-2008-0984     Insufficient integrity checking in the MP4 demuxer     allows a remote attacker to overwrite arbitrary memory     and execute arbitrary code if a maliciously crafted MP4     file is opened.

  - CVE-2008-1489     An integer overflow vulnerability in MP4 handling allows     a remote attacker to cause a heap buffer overflow,     inducing a crash and possibly the execution of arbitrary     code if a maliciously crafted MP4 file is opened.

The version of VLC Media Player installed on the remote host reportedly is affected by several security issues :

  - A subtitle buffer overflow (CVE-2007-6681).

  - A Real RTSP code execution problem (CVE-2008-0073).

  - MP4 integer overflows (CVE-2008-1489).

  - A cinepak integer overflow.

The version of VLC Media Player installed on the remote host is reportedly affected by several security issues :

 - A subtitle buffer overflow (CVE-2007-6681).
 - A Real RTSP code execution problem (CVE-2008-0073).
 - MP4 integer overflows (CVE-2008-1489).
 - A cinepak integer overflow.

ID	Name	Product	Family	Severity
32045	GLSA-200804-25 : VLC: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
31949	Debian DSA-1543-1 : vlc - several vulnerabilities	Nessus	Debian Local Security Checks	critical
31853	VLC Media Player < 0.8.6f Multiple Vulnerabilities	Nessus	Windows	high
4429	VLC Media Player < 0.8.6f Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2008-1489

high

Tenable Plugins

high

critical

high

high