'Highly critical' vulnerabilities in VLC media player

'Highly critical' vulnerabilities in VLC media player

Summary: A pair of "highly critical" vulnerabilities in the cross-platform VLC Media Player could put millions of users at risk of remote code execution attacks, according to a warning from security researchers.The issues, reported in versions 0.

SHARE:
11

Critical vulnerabilities in VLC media playerA pair of "highly critical" vulnerabilities in the cross-platform VLC Media Player could put millions of users at risk of remote code execution attacks, according to a warning from security researchers.

The issues, reported in versions 0.5.0 through 0.9.5, could let hackers take complete control of compromised machines through rigged media files. VideoLAN, the open-source group that manages the VLC project, has released patches and strongly recommends that users upgrade to VLC media player 0.9.6.

Technical details:

  • An error in the CUE demuxer can be exploited to cause a stack-based buffer overflow via a specially crafted CUE image file.
  • An error in the RealText demuxer can be exploited to cause a stack-based buffer overflow via a specially crafted RealText subtitle file.

Exploitation of this issue requires the user to explicitly open a specially crafted file.  As with any media player, the standard advice is to avoid from opening files from untrusted third parties or accessing untrusted remote sites.

Topics: Security, Hardware, Mobility

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

11 comments
Log in or register to join the discussion
  • 'Highly critical' vulnerabilities in VLC media player

    That is funny, I just upgraded to 0.9.4 yesterday from 0.8.6i. How long until we see a 0.9.6 build for us Windows users? They haven't released a 0.9.5 for Windows due to lack of developers for it.
    Loverock Davidson
    • Guess you'll have to switch to Linux (nt)

      ;)
      Michael Kelly
      • Bwahahaha

        Good joke :)
        Loverock Davidson
        • You could always

          You could always move to Mac; I'm running 0.9.6 right now :)
          Kaiwai
      • RE: Guess you'll have to switch to Linux (nt)

        Do not understand why you guys feed that troll. Probably the most annoying and offensive poster to ever grace the pages of zdnet.
        richdave
        • Nah -- Mike Cox is #1

          Oh, you think he's funny?
          PMC-CON
  • RE: 'Highly critical' vulnerabilities in VLC media player

    Download Windows build 0.9.6 here:
    http://www.free-codecs.com/download/VideoLAN.htm
    maferious
  • RE: 'Highly critical' vulnerabilities in VLC media player

    Win32 VLC 0.9.6:
    http://www.free-codecs.com/download/VideoLAN.htm
    maferious
  • Patch but Also Contain

    There are simple client security software tools that prevent exploits of applications such as VLC from being used to compromise a PC. Check out this one for Windows:

    http://www.blueridgenetworks.com/solutions/edgeguardsolo/

    As for moving to a Mac, the iPhone is one of the most attractive malware targets and it is basically a streamlined Mac OS. Less than a dozen (I believe) malware examples for iPhone found in the wild. Many exploits that would succeed on the iPhone would do so on the Mac. Today, there are orders of magnitude fewer exploits out in the wild today for Mac, that is changing for the worse. Apple's forthcoming 'Snow Leopard' OS release would do well to not only improve performance and Exchange Server integration but also security (no implication about Mac security today being good or bad; just that improvement opportunities remain).
    eiverson@...
  • RE: 'Highly critical' vulnerabilities in VLC media player

    is that VLC for MAC version which has that critical back-door
    issue?
    neohuo
  • RE: 'Highly critical' vulnerabilities in VLC media player

    Great!!! thanks for sharing this information to us!
    <a href="http://www.yuregininsesi.com">seslisohbet</a> <a href="http://www.yuregininsesi.com">seslichat</a>
    birumut