Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.

The remote host is affected by the vulnerability described in GLSA-200812-24 (VLC: Multiple vulnerabilities)

    Tobias Klein reported the following vulnerabilities:
    A     stack-based buffer overflow when processing CUE image files in     modules/access/vcd/cdrom.c (CVE-2008-5032).
    A stack-based     buffer overflow when processing RealText (.rt) subtitle files in the     ParseRealText() function in modules/demux/subtitle.c     (CVE-2008-5036).
    An integer overflow when processing RealMedia     (.rm) files in the ReadRealIndex() function in real.c in the Real     demuxer plugin, leading to a heap-based buffer overflow     (CVE-2008-5276).
  Impact :

    A remote attacker could entice a user to open a specially crafted CUE     image file, RealMedia file or RealText subtitle file, possibly     resulting in the execution of arbitrary code with the privileges of the     user running the application.
  Workaround :

    There is no known workaround at this time.

The version of VLC Media Player 0.9 installed on the remote host is earlier than 0.9.8a.  Such versions contain a heap-based integer buffer overflow in the Real demuxer plugin (libreal_plugin.*').  If an attacker can trick a user into opening a specially crafted RealMedia (.rm) file, he may be able to execute arbitrary code within the context of the affected application.

The version of VLC media player 0.9 installed on the remote host is earlier than 0.9.8a.  Such versions contain a heap-based integer buffer overflow in the Real demuxer plugin (libreal_plugin.*').  If an attacker can trick a user into opening a specially crafted RealMedia (.rm) file, arbitrary code could be executed within the context of the affected application.

Tobias Klein from TrapKit reports :

The VLC media player contains an integer overflow vulnerability while parsing malformed RealMedia (.rm) files. The vulnerability leads to a heap overflow that can be exploited by a (remote) attacker to execute arbitrary code in the context of VLC media player.

ID	Name	Product	Family	Severity
35271	GLSA-200812-24 : VLC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
4785	VLC Media Player < 0.9.8a RealMedia Processing Remote Integer Overflow (deprecated)	Nessus Network Monitor	Web Clients	medium
35068	VLC Media Player 0.9.x < 0.9.8a RealMedia Processing Remote Integer Overflow	Nessus	Windows	high
35056	FreeBSD : vlc -- arbitrary code execution in the RealMedia processor (acf80afa-c3ef-11dd-a721-0030843d3802)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2008-5276

high

Tenable Plugins

high

medium

high

high