oss-sec mailing list archives
Re: CVE request - VLC 2.0.0 to 2.0.8
From: Pedro Ribeiro <pedrib () gmail com>
Date: Thu, 3 Oct 2013 21:52:13 +0100
On 1 October 2013 16:20, Pedro Ribeiro <pedrib () gmail com> wrote:
Hi, I have discovered a denial of service / possible code execution in VLC via a crafted ASF file. This has been reported to VLC and was apparently fixed unintentionally in 2.0.8 with the entry "Improve handling of corrupt ASF files". Version 2.1.0 is not affected. The file contains a crafted ASF packet that causes VLC to crash on a read operation, with control of EDI and EAX. In the file attached you will find at starting offset 0x157AD the hex values 17 DE B4 71 in little endian, which attempts to use for a read operation. Control of other variables in the Demux function in asf.c is also possible by changing packet values before and after the offset as per the ASF specification. The file is located here: https://github.com/pedrib/PoC/blob/master/vlc-crash.asf I have not been able to obtain any program control so far, so at the moment this only crashes VLC. However someone more skilled might be able to control it. Can you please provide a CVE for this? Regards Pedro
Hi, Do you need more information on this, do not consider it CVE-worthy or just swamped with work at the moment? :) Regards, Pedro
Current thread:
- CVE request - VLC 2.0.0 to 2.0.8 Pedro Ribeiro (Oct 01)
- Re: CVE request - VLC 2.0.0 to 2.0.8 Pedro Ribeiro (Oct 03)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Kurt Seifried (Oct 03)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Hanno Böck (Oct 04)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Kurt Seifried (Oct 04)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Pedro Ribeiro (Oct 04)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Kurt Seifried (Oct 04)
- Re: Re: CVE request - VLC 2.0.0 to 2.0.8 Kurt Seifried (Oct 03)
- Re: CVE request - VLC 2.0.0 to 2.0.8 Pedro Ribeiro (Oct 03)