VideoLAN VLC Media Player 2.0.1.0 IT File memory corruption ⚔ [Disputed]

Summaryinfo

A vulnerability was found in VideoLAN VLC Media Player 2.0.1.0 and classified as problematic. This vulnerability affects unknown code of the component IT File Handler. The manipulation results in memory corruption. The attack can be launched remotely. Moreover, an exploit is present. There are still doubts about whether this vulnerability truly exists.

Detailsinfo

A vulnerability was found in VideoLAN VLC Media Player 2.0.1.0 (Multimedia Player Software). It has been classified as critical. Affected is an unknown code of the component IT File Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability.

The bug was discovered 03/15/2012. The weakness was disclosed 03/15/2012 by Dan Fosco as VLC v. 2.0.1.0 .it Memory Corruption as not defined advisory (Website). The advisory is shared for download at dfcode.org. The public release happened without coordination with the vendor. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. OSVDB notes: "Based on the provided details and additional cursory testing, there is, however, no evidence to support the claims of memory corruption and the possibility of code execution. Instead, the issue is simply considered a stability bug, causing this entry to be flagged as 'Myth/Fake'."

A public exploit has been developed by Dan Fosco in Hex File and been published immediately after the advisory. The exploit is shared for download at dfcode.org. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at OSVDB (101470†). The entries VDB-11651 and VDB-11650 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Multimedia Player Software

Vendor

• VideoLAN

Name

• VLC Media Player

Version

• 2.0.1.0

License

• open-source

Website

• Vendor: https://www.videolan.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion