Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c. NOTE: this identifier originally included an issue related to RealText, but that issue has been assigned a separate identifier, CVE-2008-5036.

Several vulnerabilities have been discovered in vlc, a multimedia player and streamer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1768     Drew Yao discovered that multiple integer overflows in     the MP4 demuxer, Real demuxer and Cinepak codec can lead     to the execution of arbitrary code.

  - CVE-2008-1769     Drew Yao discovered that the Cinepak codec is prone to a     memory corruption, which can be triggered by a crafted     Cinepak file.

  - CVE-2008-1881     Luigi Auriemma discovered that it is possible to execute     arbitrary code via a long subtitle in an SSA file.

  - CVE-2008-2147     It was discovered that vlc is prone to a search path     vulnerability, which allows local users to perform     privilege escalations.

  - CVE-2008-2430     Alin Rad Pop discovered that it is possible to execute     arbitrary code when opening a WAV file containing a     large fmt chunk.

  - CVE-2008-3794     Pinar Yanardag discovered that it is possible to     execute arbitrary code when opening a crafted mmst link.

  - CVE-2008-4686     Tobias Klein discovered that it is possible to execute     arbitrary code when opening a crafted .ty file.

  - CVE-2008-5032     Tobias Klein discovered that it is possible to execute     arbitrary code when opening an invalid CUE image file     with a crafted header.

The remote host is affected by the vulnerability described in GLSA-200812-24 (VLC: Multiple vulnerabilities)

    Tobias Klein reported the following vulnerabilities:
    A     stack-based buffer overflow when processing CUE image files in     modules/access/vcd/cdrom.c (CVE-2008-5032).
    A stack-based     buffer overflow when processing RealText (.rt) subtitle files in the     ParseRealText() function in modules/demux/subtitle.c     (CVE-2008-5036).
    An integer overflow when processing RealMedia     (.rm) files in the ReadRealIndex() function in real.c in the Real     demuxer plugin, leading to a heap-based buffer overflow     (CVE-2008-5276).
  Impact :

    A remote attacker could entice a user to open a specially crafted CUE     image file, RealMedia file or RealText subtitle file, possibly     resulting in the execution of arbitrary code with the privileges of the     user running the application.
  Workaround :

    There is no known workaround at this time.

A version of VLC between 0.5.0 and 0.9.5 is installed on the remote host.  Such versions are affected by the following vulnerabilities : 

  - RealText subtitle file (modules\demux\subtitle.c) processing is susceptible to a buffer overflow caused by user-supplied data from a malicious subtitle file being copied into static buffers without proper validation.
  - CUE image file (modules\access\vcd\cdrom.c) processing is susceptible to a stack-based buffer overflow because data supplied by the CUE file is supplied as an array index without proper validation.

An attacker may be able to leverage these issues to execute arbitrary code on the remote host by tricking a user into opening a specially crafted video file using the affected application.

A version of VLC between 0.5.0 and 0.9.5 is installed on the remote host.  Such versions are affected by the following vulnerabilities :

  - RealText subtitle file (modules\demux\subtitle.c)     processing is susceptible to a buffer overflow caused     by user-supplied data from a malicious subtitle file     being copied into static buffers without proper     validation.

  - CUE image file (modules\access\vcd\cdrom.c)     processing is susceptible to a stack-based buffer     overflow because data supplied by the CUE file is     supplied as an array index without proper validation.

An attacker may be able to leverage these issues to execute arbitrary code on the remote host by tricking a user into opening a specially crafted video file using the affected application.

The VLC Team reports :

The VLC media player contains a stack overflow vulnerability while parsing malformed cue files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of VLC media player.

ID	Name	Product	Family	Severity
39451	Debian DSA-1819-1 : vlc - several vulnerabilities	Nessus	Debian Local Security Checks	high
35271	GLSA-200812-24 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
4747	VLC Media Player 0.5.0 to 0.9.5 Stack-Based Buffer Overflows	Nessus Network Monitor	Web Clients	medium
34730	VLC Media Player 0.5.0 to 0.9.5 Stack-Based Buffer Overflows	Nessus	Windows	high
34723	FreeBSD : vlc -- cue processing stack overflow (4b09378e-addb-11dd-a578-0030843d3802)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2008-5032

high

Tenable Plugins

high

high

medium

high

high