Re: Re: CVE request - VLC 2.0.0 to 2.0.8

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/03/2013 02:52 PM, Pedro Ribeiro wrote:
> On 1 October 2013 16:20, Pedro Ribeiro <pedrib () gmail com> wrote:
> > Hi,
> >
> > I have discovered a denial of service / possible code execution
> > in VLC via a crafted ASF file. This has been reported to VLC and
> > was apparently fixed unintentionally in 2.0.8 with the entry
> > "Improve handling of corrupt ASF files". Version 2.1.0 is not
> > affected.
> >
> > The file contains a crafted ASF packet that causes VLC to crash
> > on a read operation, with control of EDI and EAX. In the file
> > attached you will find at starting offset 0x157AD the hex values
> > 17 DE B4 71 in little endian, which attempts to use for a read
> > operation. Control of other variables in the Demux function in
> > asf.c is also possible by changing packet values before and after
> > the offset as per the ASF specification.
> >
> > The file is located here: 
> > https://github.com/pedrib/PoC/blob/master/vlc-crash.asf
> >
> > I have not been able to obtain any program control so far, so at
> > the moment this only crashes VLC. However someone more skilled
> > might be able to control it.
> >
> > Can you please provide a CVE for this?
> >
> > Regards Pedro
>
>
> Hi,
>
> Do you need more information on this, do not consider it CVE-worthy
> or just swamped with work at the moment? :)
>
> Regards, Pedro

Sorry forgot to reply. I'm not sure this is CVE worthy. In general
crash bugs in services are CVE worthy, but crashes in client software
are usually limited to things like email clients or web browsers where
there is a high potential for processing untrusted data without much
user interaction (e.g. displaying some random email or web page) whre
you also have the potential to lose work (so there is an impact).

In the case of VLC you load a nasty file, it crashes, you don't do it
again. There's not really any impact. You don't lose any work.

Now the question becomes "possible code execution" is how possible?
This is based on the fact that memory corruption occurs, or is there
more evidence?

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)

iQIcBAEBAgAGBQJSTkTLAAoJEBYNRVNeJnmTl8QQALyLEkBcN6TXi6UHp19HXjfw
Iigyag+FoFseJtIO1MdB8Qq4PYhLXCUJJ/6Lhe4ZLZJ3XdAQL9EjXqH2ehWfgWQh
V5qnKT+wlrUb8WTrTFTiOQHzmyd/Z/Q+Sp66+OGJ2upSp0ZutA0/1WVFK6U9SE2V
YEPQzgh15g8WRufiJut1y+yUpiVpoSU8XQniLTFnxROkRSMXAx4pDtILRdYPvNNv
QVk3/pV+c8qJzy5T+BrC4dV2dC5gKsRZH0NZdUDU7t0Zp87AOdVEQpuZrmmjbaby
8N6/c+G70GUcZ0U0Pqsecf8UYrbD+Mw379gbZQDRFMBrZxLH4fS8i5moYnM7scsh
twDQKFPZ7IwUe1cT16bFHBog9joZm+DBMk4kf96rEudhsEF8uiv+moZt0ZDAODZx
8ZQmBeFpQ+hfv8n9gkwehT4FaJ/o6kK+PHDFHOCplA5ljbFuUufg7HzSsOb8mSHV
GeChKkdEbdqAFgBwIUjMgBHq47Irz4ZMgIhwni+3knczwvuhdJTFDwn777LdlbIg
VjL+Ws2fTUsVFVQ7VpWwrJ24Rk3DP5dlk9BLNIGkvw6Z9fzUievwBjotdlFrwczo
XyfY2bi4ms6nLGyct0L1OTwoFQ9P4NxmVSSgRNW8kZlLPmEKInpf5q990oZX3hX7
+rRU7rmQlA1pjBCxBNh1
=qnq6
-----END PGP SIGNATURE-----