VLC Vulnerability

VLC Player Vulnerable to Remote Hijack - TorrentFreak

This caught my eye because it's my favorite, low-impact play-anything media player.

Quote:

---

The problem occurs when a someone loads a subtitle file, which causes a buffer overflow that can be exploited. The security flaw is platform independent, which means it affects Windows, Mac and Linux users.

Initially it was reported that the flaws in version 0.8.6d were fixed in the latest release, but this turns out not to be the case. Auriemma writes: “The old buffer-overflow in the subtitles handled by VLC has not been fully patched in version 0.8.6e.”

---

- via gHacks

hmm... I have never heard of VLC... probably because I am never in the need for a media player! From the article it looks to be pretty good, but I don't use BitTorrents...

interesting vulnerability

Yeah, VLC is a barebones yet very capable player. It's not pretty, but it beats the pants off the mess that is Windows Media Player.

I fail to see how this can be exploited remotely?

Quote:

---

The problem occurs when a someone loads a subtitle file, which causes a buffer overflow that can be exploited. The security flaw is platform independent, which means it affects Windows, Mac and Linux users.

---

Unless a malicious file is run... how is this going to work? To people hook VLC into their browsers or what?

I think it can be used to view video streams as well as function as a streaming server.

http://www.videolan.org/vlc/features.html

Not a huge video expert here, so someone else will have to fill in the blanks...

Ouch - I use VLC for playing .avi files on my Mac!

Hmm I use VLC for everything. How can you not heard of VLC :P

Quote:

---

Originally Posted by Soda_Popinsky

I fail to see how this can be exploited remotely?



Unless a malicious file is run... how is this going to work? To people hook VLC into their browsers or what?

---

The attack vector requires very specific conditions, none of which apply to you as an average user.

--TH13

Quote:

---

none of which apply to you as an average user.

---

Burn!!!

LOL.

Soda, "you" was not implied literally to you.

;)

well i may be average, but at least I'm not mean.

(math pun ftw)

Yes, I caught the math reference.
;)

Interesting. I haven't heard of it either...Looks like it's time to change that.

So would such a vulnerability matter if the machine in question is properly firewalled? I suppose the vulnerability would take advantage of said firewall trusting in/out traffic managed by the player?

I am going to show this to a friend of mine because he watches a lot of anime and he could vbe affected. But Yes VLC is a great player and does just about anything.