Lucene search

[email protected]CVE-2010-3124

HistoryAug 26, 2010 - 6:36 p.m.

CVE-2010-3124

2010-08-2618:36:35

[email protected]

web.nvd.nist.gov

vlc media player

cve-2010-3124

untrusted search path vulnerability

arbitrary code execution

dll hijacking

nvd

7.4 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.585 Medium

EPSS

Percentile

97.7%

JSON

Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .mp3 file.

Affected configurations

NVD

Node

videolanvlc_media_playerRange≤1.1.3

videolanvlc_media_playerMatch0.1.99b

videolanvlc_media_playerMatch0.1.99e

videolanvlc_media_playerMatch0.1.99f

videolanvlc_media_playerMatch0.1.99g

videolanvlc_media_playerMatch0.1.99h

videolanvlc_media_playerMatch0.1.99i

videolanvlc_media_playerMatch0.2.0

videolanvlc_media_playerMatch0.2.60

videolanvlc_media_playerMatch0.2.61

videolanvlc_media_playerMatch0.2.62

videolanvlc_media_playerMatch0.2.63

videolanvlc_media_playerMatch0.2.70

videolanvlc_media_playerMatch0.2.71

videolanvlc_media_playerMatch0.2.72

videolanvlc_media_playerMatch0.2.73

videolanvlc_media_playerMatch0.2.80

videolanvlc_media_playerMatch0.2.81

videolanvlc_media_playerMatch0.2.82

videolanvlc_media_playerMatch0.2.83

videolanvlc_media_playerMatch0.2.90

videolanvlc_media_playerMatch0.2.91

videolanvlc_media_playerMatch0.2.92

videolanvlc_media_playerMatch0.3.0

videolanvlc_media_playerMatch0.3.1

videolanvlc_media_playerMatch0.4.0

videolanvlc_media_playerMatch0.4.1

videolanvlc_media_playerMatch0.4.2

videolanvlc_media_playerMatch0.4.3

videolanvlc_media_playerMatch0.4.4

videolanvlc_media_playerMatch0.4.5

videolanvlc_media_playerMatch0.4.6

videolanvlc_media_playerMatch0.5.0

videolanvlc_media_playerMatch0.5.1

videolanvlc_media_playerMatch0.5.2

videolanvlc_media_playerMatch0.5.3

videolanvlc_media_playerMatch0.6.0

videolanvlc_media_playerMatch0.6.1

videolanvlc_media_playerMatch0.6.2

videolanvlc_media_playerMatch0.7.0

videolanvlc_media_playerMatch0.7.2

videolanvlc_media_playerMatch0.8.0

videolanvlc_media_playerMatch0.8.1

videolanvlc_media_playerMatch0.8.2

videolanvlc_media_playerMatch0.8.4

videolanvlc_media_playerMatch0.8.5

videolanvlc_media_playerMatch0.8.6

videolanvlc_media_playerMatch0.9.2

videolanvlc_media_playerMatch0.9.3

videolanvlc_media_playerMatch0.9.4

videolanvlc_media_playerMatch0.9.5

videolanvlc_media_playerMatch0.9.6

videolanvlc_media_playerMatch0.9.8a

videolanvlc_media_playerMatch0.9.9

videolanvlc_media_playerMatch0.9.10

videolanvlc_media_playerMatch1.0.0

videolanvlc_media_playerMatch1.0.1

videolanvlc_media_playerMatch1.0.2

videolanvlc_media_playerMatch1.0.3

videolanvlc_media_playerMatch1.0.4

videolanvlc_media_playerMatch1.0.5

videolanvlc_media_playerMatch1.0.6

videolanvlc_media_playerMatch1.1.0

videolanvlc_media_playerMatch1.1.1

videolanvlc_media_playerMatch1.1.2

CPENameOperatorVersion
videolan:vlc_media_playervideolan vlc media playerle1.1.3
videolan:vlc_media_playervideolan vlc media playereq0.1.99b
videolan:vlc_media_playervideolan vlc media playereq0.1.99e
videolan:vlc_media_playervideolan vlc media playereq0.1.99f
videolan:vlc_media_playervideolan vlc media playereq0.1.99g
videolan:vlc_media_playervideolan vlc media playereq0.1.99h
videolan:vlc_media_playervideolan vlc media playereq0.1.99i
videolan:vlc_media_playervideolan vlc media playereq0.2.0
videolan:vlc_media_playervideolan vlc media playereq0.2.60
videolan:vlc_media_playervideolan vlc media playereq0.2.61

CPE	Name	Operator	Version
videolan:vlc_media_player	videolan vlc media player	le	1.1.3
videolan:vlc_media_player	videolan vlc media player	eq	0.1.99b
videolan:vlc_media_player	videolan vlc media player	eq	0.1.99e
videolan:vlc_media_player	videolan vlc media player	eq	0.1.99f
videolan:vlc_media_player	videolan vlc media player	eq	0.1.99g
videolan:vlc_media_player	videolan vlc media player	eq	0.1.99h
videolan:vlc_media_player	videolan vlc media player	eq	0.1.99i
videolan:vlc_media_player	videolan vlc media player	eq	0.2.0
videolan:vlc_media_player	videolan vlc media player	eq	0.2.60
videolan:vlc_media_player	videolan vlc media player	eq	0.2.61

Rows per page:

1-10 of 651

References

git.videolan.org/?p=vlc/vlc-1.1.git%3Ba=blobdiff%3Bf=bin/winvlc.c%3Bh=ac9b97ca9f5f9ba001f13bf61eb5127a1c1dbcbf%3Bhp=2d09cba320e3b0def7069ce1ebab25d1340161c5%3Bhb=43a31df56c37bd62c691cdbe3c1f11babd164b56%3Bhpb=2d366da738b19f8d761d7084746c6db6f52808c6

secunia.com/advisories/41107

www.exploit-db.com/exploits/14750

www.openwall.com/lists/oss-security/2010/08/25/10

www.openwall.com/lists/oss-security/2010/08/25/9

www.vupen.com/english/advisories/2010/2172

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12190