Buffer-overflow and format string in VideoLAN VLC 0.8.6d




#######################################################################

Luigi Auriemma

Application: VideoLAN (VLC)
http://www.videolan.org
Versions: <= 0.8.6d
Platforms: Windows, Mac, *BSD, *nix and more
Bugs: A] buffer-overflow in the handling of the subtitles
(originally found by Michal Luczaj)
B] format string in the web interface
Exploitation: A] local
B] remote
Date: 24 Dec 2007
Author: Luigi Auriemma
e-mail: aluigi@xxxxxxxxxxxxx
web: aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


VideoLAN (VLC) is one of the most famous and used media players for
various reasons: simple to use, open source, multi platform, many
features available, continuosly updated and more.


#######################################################################

=======
2) Bugs
=======

---------------------------------------------------
A] buffer-overflow in the handling of the subtitles
---------------------------------------------------

VLC is able to handle the subtitles automatically in a very simple way,
it just checks the presence of ssa files with the same name of the
loaded video and a possible subtitles folder.
The functions which handle the MicroDvd, SSA and Vplayer subtitle
formats are vulnerable to some stack based buffer-overflow
vulnerabilities which can allow an attacker to execute malicious code.

from modules\demux\subtitle.c:

static int ParseMicroDvd( demux_t *p_demux, subtitle_t *p_subtitle )
...
char buffer_text[MAX_LINE + 1];
...
if( sscanf( s, "{%d}{}%[^\r\n]", &i_start, buffer_text ) == 2 ||
sscanf( s, "{%d}{%d}%[^\r\n]", &i_start, &i_stop, buffer_text ) == 3)

static int ParseSSA( demux_t *p_demux, subtitle_t *p_subtitle )
...
char buffer_text[ 10 * MAX_LINE];
char buffer_text2[ 10 * MAX_LINE];
...
if( sscanf( s,
"Dialogue: %[^,],%d:%d:%d.%d,%d:%d:%d.%d,%[^\r\n]",
buffer_text2,
&h1, &m1, &s1, &c1,
&h2, &m2, &s2, &c2,
buffer_text ) == 10 )

static int ParseVplayer( demux_t *p_demux, subtitle_t *p_subtitle )
...
char buffer_text[MAX_LINE + 1];
...
if( sscanf( p, "%d:%d:%d%[ :]%[^\r\n]", &h, &m, &s, &c, buffer_text ) == 5 )


As written in the header of this advisory, these buffer-overflow bugs
have been originally found and reported by Michal Luczaj this summer
and the strange thing is that the SVN is fixed from that time BUT the
current 0.8.6d (both executables and source code!) is still vulnerable.
References:

http://mailman.videolan.org/pipermail/vlc-devel/2007-June/032672.html
http://mailman.videolan.org/pipermail/vlc-devel/2007-June/033394.html
http://trac.videolan.org/vlc/browser/trunk/modules/demux/subtitle.c?rev=20715


-------------------------------------
B] format string in the web interface
-------------------------------------

VLC can be controlled remotely through a nice web interface (a mini
http server) which runs by default on port 8080.
The instructions which handle the Connection parameter sent by the
client pass its content to the httpd_MsgAdd function without the
needed format argument.
In addition the new formatted Connection field is also sent back by the
server in its reply, very useful for the attacker to tune the own
exploit for increasing the percentage of success of the attack.

from network\httpd.c:

static int httpd_FileCallBack( httpd_callback_sys_t *p_sys, httpd_client_t *cl, httpd_message_t *answer, httpd_message_t *query )
...
psz_connection = httpd_MsgGet( &cl->query, "Connection" );
if( psz_connection != NULL )
{
httpd_MsgAdd( answer, "Connection", psz_connection );
}


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/vlcboffs.zip

A] open vlcbof.avi and the ssa subtitle will be loaded automatically

B] nc SERVER 8080 -v -v < vlcfs.txt


#######################################################################

======
4) Fix
======


Current SVN is fixed.
The nightly builds are available here:

http://nightlies.videolan.org


#######################################################################


---
Luigi Auriemma
http://aluigi.org



Relevant Pages

  • [Full-disclosure] Buffer-overflow and format string in VideoLAN VLC 0.8.6d
    ... Application: VideoLAN (VLC) ... B] format string in the web interface ... VLC is able to handle the subtitles automatically in a very simple way, ...
    (Full-Disclosure)
  • Re: m4p to mp3 conversion
    ... The original file format may be of several types, ... I wish to save the audio component and in particular ... flac file format, which seems to work. ... I tried using VLC to get the audio from commercial DVDs with LPCM ...
    (comp.sys.acorn.apps)
  • RE: Dumb question time: How do I insert a hyperlink?
    ... web interface on this News Group. ... Microsoft PowerPoint MVP Team ... >> messages in HTML format. ...
    (microsoft.public.powerpoint)
  • Re: Get_Video from Youtube
    ... Once renamed and drug to File Buddy, ... If I rename it as wmv it tells me the type/creator is ASF_ and VLC# ... Any help with what format these files *really* are, ...
    (comp.sys.mac.apps)
  • Re: Problems playing .avi files
    ... I am still on F9 and I am having problems playing .avi files. ... vlc can't recognize the format, other programs say the codecs are ... .avi is a packaging format for media files, ... that require an assortment of different codecs. ...
    (Fedora)