oss-sec mailing list archives
Re: Re: CVE request - VLC 2.0.0 to 2.0.8
From: Kurt Seifried <kseifried () redhat com>
Date: Thu, 03 Oct 2013 22:32:12 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/03/2013 02:52 PM, Pedro Ribeiro wrote:
On 1 October 2013 16:20, Pedro Ribeiro <pedrib () gmail com> wrote:Hi, I have discovered a denial of service / possible code execution in VLC via a crafted ASF file. This has been reported to VLC and was apparently fixed unintentionally in 2.0.8 with the entry "Improve handling of corrupt ASF files". Version 2.1.0 is not affected. The file contains a crafted ASF packet that causes VLC to crash on a read operation, with control of EDI and EAX. In the file attached you will find at starting offset 0x157AD the hex values 17 DE B4 71 in little endian, which attempts to use for a read operation. Control of other variables in the Demux function in asf.c is also possible by changing packet values before and after the offset as per the ASF specification. The file is located here: https://github.com/pedrib/PoC/blob/master/vlc-crash.asf I have not been able to obtain any program control so far, so at the moment this only crashes VLC. However someone more skilled might be able to control it. Can you please provide a CVE for this? Regards PedroHi, Do you need more information on this, do not consider it CVE-worthy or just swamped with work at the moment? :) Regards, Pedro
Sorry forgot to reply. I'm not sure this is CVE worthy. In general crash bugs in services are CVE worthy, but crashes in client software are usually limited to things like email clients or web browsers where there is a high potential for processing untrusted data without much user interaction (e.g. displaying some random email or web page) whre you also have the potential to lose work (so there is an impact). In the case of VLC you load a nasty file, it crashes, you don't do it again. There's not really any impact. You don't lose any work. Now the question becomes "possible code execution" is how possible? This is based on the fact that memory corruption occurs, or is there more evidence? - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQIcBAEBAgAGBQJSTkTLAAoJEBYNRVNeJnmTl8QQALyLEkBcN6TXi6UHp19HXjfw Iigyag+FoFseJtIO1MdB8Qq4PYhLXCUJJ/6Lhe4ZLZJ3XdAQL9EjXqH2ehWfgWQh V5qnKT+wlrUb8WTrTFTiOQHzmyd/Z/Q+Sp66+OGJ2upSp0ZutA0/1WVFK6U9SE2V YEPQzgh15g8WRufiJut1y+yUpiVpoSU8XQniLTFnxROkRSMXAx4pDtILRdYPvNNv QVk3/pV+c8qJzy5T+BrC4dV2dC5gKsRZH0NZdUDU7t0Zp87AOdVEQpuZrmmjbaby 8N6/c+G70GUcZ0U0Pqsecf8UYrbD+Mw379gbZQDRFMBrZxLH4fS8i5moYnM7scsh twDQKFPZ7IwUe1cT16bFHBog9joZm+DBMk4kf96rEudhsEF8uiv+moZt0ZDAODZx 8ZQmBeFpQ+hfv8n9gkwehT4FaJ/o6kK+PHDFHOCplA5ljbFuUufg7HzSsOb8mSHV GeChKkdEbdqAFgBwIUjMgBHq47Irz4ZMgIhwni+3knczwvuhdJTFDwn777LdlbIg VjL+Ws2fTUsVFVQ7VpWwrJ24Rk3DP5dlk9BLNIGkvw6Z9fzUievwBjotdlFrwczo XyfY2bi4ms6nLGyct0L1OTwoFQ9P4NxmVSSgRNW8kZlLPmEKInpf5q990oZX3hX7 +rRU7rmQlA1pjBCxBNh1 =qnq6 -----END PGP SIGNATURE-----
Current thread:
- CVE request - VLC 2.0.0 to 2.0.8 Pedro Ribeiro (Oct 01)
- Re: CVE request - VLC 2.0.0 to 2.0.8 Pedro Ribeiro (Oct 03)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Kurt Seifried (Oct 03)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Hanno Böck (Oct 04)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Kurt Seifried (Oct 04)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Pedro Ribeiro (Oct 04)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Kurt Seifried (Oct 04)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Kurt Seifried (Oct 03)
- Re: CVE request - VLC 2.0.0 to 2.0.8 Pedro Ribeiro (Oct 03)