Security Advisory 0801

Summary           : Format string vulnerability in the Web interface
                    Stack-based buffer overflow in the Subtitles demuxer
                    String buffer overflows in the Real RTSP demuxer
Date              : 27 February 2008, 2 April 2008
Affected versions : VLC media player 0.8.6d and earlier
ID                : VideoLAN-SA-0801
CVE references    : CVE-2007-6681, CVE-2007-6682, CVE-2008-0295, CVE-2008-0296

Details

VLC media player's web interface suffers from a format string vulnerability when using specially crafted requests.

Its subtitle demuxer is prone to multiple buffer overflows triggered by parsing maliciously crafted files.

Its Real RTSP demuxer is based upon an older Xine library fork, which is prone to multiple buffer overflows triggered by maliciously crafted Session Description Protocol (SDP) data or by specific RTSP server responses.

Impact

If successful, a malicious third party could remotely use the Web interface or the Real RTSP demuxer or locally trigger the subtitles parser to execute arbitrary code within the context of VLC media player or crash the current player instance.

Threat mitigation

Exploitation of the Web interface problem requires the user to explicitly enable this interface. It is disabled by default.

Subtitle files can be manually opened by the user or automatically based on the filename of the movie. Both ways may lead to exploitation of the Subtitle Parser's buffer-overflow.

Exploitation of the Real RTSP problems requires the user to explicitly open streams provided by malicious third parties.

Workarounds

The user may refrain from using the Web interface until an update is installed or limit its usage to secure environments. VLC media player can also be controlled remotely through the RC and telnet interfaces.

Automatic detection of subtitle files can be disabled by unchecking the "Autodetect subtitle files" option in the Subtitle category inside the Video preferences. Note that you need to restart VLC media player for this change to take effect. In case that you use VLC media player through the command-line, provide --no-sub-autodetect-file to override its default behavior.

The user is asked to use subtitle files authored by trusted sources only.

The user is asked to only open Real RTSP streams from trusted content providers. In case of uncertainess, it is recommended not to open this kind of streams. RTSP streams can easily be identified by the rtsp prefix of their URL/MRL.

Solution

VLC media player 0.8.6e addresses these issues and introduces further usability fixes. Version 0.8.6f implements additional security improvements to the Subtitle Parser.

Pre-compiled packages will be available at the usual download locations shortly.

Credits

The Subtitle Parser vulnerability was discovered by Michal Luczaj.

The Web interface vulnerability was reported by Luigi Auriemma.

The Real RTSP demuxer vulnerabilities were published by Luigi Auriemma.

References

Luigi Auriemma

Luigi Auriemma, Buffer overflow and format string in VideoLAN's VLC 0.8.6d Heap overflow in sdpplin_parse and possible heap overflow in VideoLAN's VLC 0.8.6d

The VideoLAN Project

http://www.videolan.org/

History

2 April 2008

VLC 0.8.6f bugfix release

27 February 2008

VLC 0.8.6e bugfix release

20 January 2008

Source code fixes to the Real RTSP demuxer for VLC 0.8.6d and development tree

10 January 2008

Real RTSP demuxer issues published by Luigi Auriemma

24 December 2007

Web Interface and Subtitle Demuxer bugs reported by Luigi Auriemma

Source code fixes to these issues for VLC 0.8.6d and development tree