[NT] VLC Media Player WAV Processing Integer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



VLC Media Player WAV Processing Integer Overflow
------------------------------------------------------------------------


SUMMARY

" <http://www.videolan.org/vlc/> VLC media player is a highly portable
multimedia player for various audio and video formats (MPEG-1, MPEG-2,
MPEG-4, DivX, mp3, ogg, ...) as well as DVDs, VCDs, and various streaming
protocols." Secunia Research has discovered a vulnerability in VLC Media
Player, which can be exploited by malicious people to compromise a user's
system.

DETAILS

Vulnerable Systems:
* VLC Media Player version 0.8.6h (Windows)

Immune Systems:
* VLC Media Player version 0.8.6i

The vulnerability is caused due to an integer overflow error within the
"Open()" function in modules/demux/wav.c. This can be exploited to cause a
heap-based buffer overflow via a specially crafted WAV file having an
overly large "fmt" chunk.

Successful exploitation may allow execution of arbitrary code.

Time Table:
27/06/2008 - Vendor notified.
30/06/2008 - Vendor response.
02/07/2008 - Public disclosure.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2430>
CVE-2008-2430


ADDITIONAL INFORMATION

The information has been provided by Secunia Research.
The original article can be found at:
<http://secunia.com/secunia_research/2008-29/>
http://secunia.com/secunia_research/2008-29/



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [UNIX] Multiple Vendor xzgv PRF Parsing Integer Overflow Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Remote exploitation of an integer overflow vulnerability in various ... Vendor Response: ...
    (Securiteam)
  • [UNIX] Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, ... Integer Overflow) ... In order to exploit this vulnerability, an attacker simply needs to be ...
    (Securiteam)
  • [NT] VLC ActiveX Bad Pointer Initialization Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... VLC ActiveX Bad Pointer Initialization Vulnerability ... VLC media player versions prior to 0.86 ...
    (Securiteam)
  • [NEWS] VLC Media Player UDP URL Handler Format String Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... VLC Media Player UDP URL Handler Format String Vulnerability ... Player for OSX to execute arbitrary code. ...
    (Securiteam)
  • [EXPL] VLC Media Player DoS (Exploit)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... VLC Media Player DoS ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)