-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2008.0014                  AUSCERT Advisory

                             [Win][UNIX/Linux]
                  Multiple vulnerabilities in VLC Player
                              18 January 2008
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              VLC Player
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Execute Arbitrary Code/Commands
                      Denial of Service
                      Modify Arbitrary Files
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-6681 CVE-2007-6682 CVE-2007-6683
                      CVE-2007-6684 CVE-2008-0295 CVE-2008-0296
Member content until: Friday, February 15 2008

OVERVIEW:

       Multiple vulnerabilities have been reported in VideoLAN VLC 0.8.6d
       and prior which if successfully exploited can result in the remote
       execution of arbitrary code, a denial of service (DoS), or the
       modification of arbitrary files.


IMPACT:

       The National Vulnerability Database [1], gives the following
       information regarding these vulnerabilities:

       o CVE-2007-6681: "Stack-based buffer overflow in 
         modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote 
         attackers to execute arbitrary code via a long subtitle in a (1) 
         MicroDvd, (2) SSA, and (3) Vplayer file." [2]

       o CVE-2007-6682: "Format string vulnerability in the 
         httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 
         0.8.6d allows remote attackers to execute arbitrary code via format 
         string specifiers in the Connection parameter." [3]

       o CVE-2007-6683: "The browser plugin in VideoLAN VLC 0.8.6d allows 
         remote attackers to overwrite arbitrary files via (1) the 
         :demuxdump-file option in a filename in a playlist, or (2) a 
         EXTVLCOPT statement in an MP3 file, possibly an argument injection 
         vulnerability." [4] 

       o CVE-2007-6684: "The RTSP module in VideoLAN VLC 0.8.6d allows 
         remote attackers to cause a denial of service (crash) via a request 
         without a Transport parameter, which triggers a NULL pointer 
         dereference." [5]

       o CVE-2008-0295: "Heap-based buffer overflow in 
         modules/access/rtsp/real_sdpplin.c in the Xine library, as used in 
         VideoLAN VLC Media Player 0.8.6d and earlier, allows user-assisted 
         remote attackers to cause a denial of service (crash) or execute 
         arbitrary code via long Session Description Protocol (SDP) data. 
         [6]

       o CVE-2008-0296: "Heap-based buffer overflow in the 
         libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and 
         earlier on Windows might allow remote RTSP servers to cause a 
         denial of service (application crash) or execute arbitrary code 
         via a long string." [7]


MITIGATION:

        At this stage there is no solution to these vulnerabilities but 
        there are a number of interim steps you can take to protect
        yourself against these attacks:
        - Restrict access to the VLC player to the local network
        - Disable the web interface (if it has been enabled)
        - Only open media from trusted sources
        - remove the file associations for VLC player so that it is not
          immediately started when a user opens a multimedia file


REFERENCES:

        [1] National Vulnerability Database
            http://nvd.nist.gov/

        [2] National Vulnerability Database (CVE-2007-6681)
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6681

        [3] National Vulnerability Database (CVE-2007-6682)
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6682

        [4] National Vulnerability Database (CVE-2007-6683)
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6683

        [5] National Vulnerability Database (CVE-2007-6684)
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6684

        [6] National Vulnerability Database (CVE-2008-0295)
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0295

        [7] National Vulnerability Database (CVE-2008-0296)
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0296

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBR5AkmCh9+71yA2DNAQJuWgP7BQP5lvhU3W56li1Sx5A6PJog5pe2ousl
yZcgI9vrqdFShiTb6VH0VYuxt6a2TMvvz3nGxYSBJVSN6HsZxm1gLXZq+MZtGqDR
Vm3XT8hWKLVln0vX+/tuqWzRsSBNErDLJvFZD5hqdi0124DUQgMFKa5xN37zKqhp
HBWRRxxCSUk=
=jxNx
-----END PGP SIGNATURE-----