Page 1 of 2 12 LastLast
Results 1 to 10 of 14

Thread: VLC Vulnerability

  1. March 19th, 2008, 04:57 PM #1
    phernandez
    phernandez is offline
    Senior Member phernandez's Avatar
    Join Date
    Aug 2003
    Location
    NYC
    Posts
    246

    VLC Vulnerability

    VLC Player Vulnerable to Remote Hijack - TorrentFreak

    This caught my eye because it's my favorite, low-impact play-anything media player.

    The problem occurs when a someone loads a subtitle file, which causes a buffer overflow that can be exploited. The security flaw is platform independent, which means it affects Windows, Mac and Linux users.

    Initially it was reported that the flaws in version 0.8.6d were fixed in the latest release, but this turns out not to be the case. Auriemma writes: “The old buffer-overflow in the subtitles handled by VLC has not been fully patched in version 0.8.6e.”
    - via gHacks
    http://www.eITplanet.com | http://blog.eITplanet.com/green
    Reply With Quote Reply With Quote
  2. March 19th, 2008, 09:19 PM #2
    ArPaNET
    ArPaNET is offline
    Senior Member
    Join Date
    Oct 2007
    Location
    do a whois search on my ip...
    Posts
    268
    hmm... I have never heard of VLC... probably because I am never in the need for a media player! From the article it looks to be pretty good, but I don't use BitTorrents...

    interesting vulnerability
    Reply With Quote Reply With Quote
  3. March 19th, 2008, 09:25 PM #3
    phernandez
    phernandez is offline
    Senior Member phernandez's Avatar
    Join Date
    Aug 2003
    Location
    NYC
    Posts
    246
    Yeah, VLC is a barebones yet very capable player. It's not pretty, but it beats the pants off the mess that is Windows Media Player.
    http://www.eITplanet.com | http://blog.eITplanet.com/green
    Reply With Quote Reply With Quote
  4. March 19th, 2008, 09:32 PM #4
    Soda_Popinsky
    Soda_Popinsky is offline
    Join Date
    Nov 2003
    Posts
    1,426
    I fail to see how this can be exploited remotely?

    The problem occurs when a someone loads a subtitle file, which causes a buffer overflow that can be exploited. The security flaw is platform independent, which means it affects Windows, Mac and Linux users.
    Unless a malicious file is run... how is this going to work? To people hook VLC into their browsers or what?
    Reply With Quote Reply With Quote
  5. March 19th, 2008, 10:45 PM #5
    phernandez
    phernandez is offline
    Senior Member phernandez's Avatar
    Join Date
    Aug 2003
    Location
    NYC
    Posts
    246
    I think it can be used to view video streams as well as function as a streaming server.

    http://www.videolan.org/vlc/features.html

    Not a huge video expert here, so someone else will have to fill in the blanks...
    http://www.eITplanet.com | http://blog.eITplanet.com/green
    Reply With Quote Reply With Quote
  6. March 20th, 2008, 02:32 AM #6
    niggles
    niggles is offline
    Member
    Join Date
    Oct 2006
    Posts
    41
    Ouch - I use VLC for playing .avi files on my Mac!
    Reply With Quote Reply With Quote
  7. March 20th, 2008, 03:02 PM #7
    Cider
    Cider is offline
    Only african to own a PC! Cider's Avatar
    Join Date
    Jun 2003
    Location
    Israel
    Posts
    1,683
    Hmm I use VLC for everything. How can you not heard of VLC :P
    The world is a dangerous place to live; not because of the people who are evil, but because of the people who don't do anything about it.
    Albert Einstein
    Reply With Quote Reply With Quote
  8. March 20th, 2008, 03:24 PM #8
    thehorse13
    thehorse13 is offline
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,885
    Quote Originally Posted by Soda_Popinsky
    I fail to see how this can be exploited remotely?



    Unless a malicious file is run... how is this going to work? To people hook VLC into their browsers or what?
    The attack vector requires very specific conditions, none of which apply to you as an average user.

    --TH13
    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
    Reply With Quote Reply With Quote
  9. March 20th, 2008, 06:54 PM #9
    Soda_Popinsky
    Soda_Popinsky is offline
    Join Date
    Nov 2003
    Posts
    1,426
    none of which apply to you as an average user.
    Burn!!!
    Reply With Quote Reply With Quote
  10. March 20th, 2008, 08:15 PM #10
    thehorse13
    thehorse13 is offline
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,885
    LOL.

    Soda, "you" was not implied literally to you.

    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Similar Threads

  1. Browser Security Test
    By therenegade in forum Web Security
    Replies: 13
    Last Post: April 1st, 2005, 09:03 AM
  2. October MS updates
    By mohaughn in forum Microsoft Security Discussions
    Replies: 2
    Last Post: October 13th, 2004, 04:31 AM
  3. Securing Windows 2000 and IIS
    By spools.exe in forum Microsoft Security Discussions
    Replies: 0
    Last Post: September 15th, 2003, 09:47 PM
  4. NEWS: SANS Critical Vulnerability Report
    By xmaddness in forum Miscellaneous Security Discussions
    Replies: 0
    Last Post: January 28th, 2003, 09:12 PM
  5. IIS Patch announcement
    By souleman in forum Microsoft Security Discussions
    Replies: 5
    Last Post: April 11th, 2002, 11:39 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules