Lucene search

K
saintSAINT CorporationSAINT:3C58B2EF8396680098CF4DD9D79F214C
HistoryDec 01, 2008 - 12:00 a.m.

VLC media player RealText subtitle file ParseRealText buffer overflow

2008-12-0100:00:00
SAINT Corporation
download.saintcorporation.com
15

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.97 High

EPSS

Percentile

99.8%

Added: 12/01/2008
CVE: CVE-2008-5036
BID: 32125
OSVDB: 49809

Background

VLC media player is a media player supporting various audio and video formats for multiple platforms.

Problem

A buffer overflow vulnerability in the ParseRealText function allows command execution when a user opens a media file which references a specially crafted RealText subtitle file.

Resolution

Upgrade to VLC media player 0.9.6 or higher.

References

<http://www.videolan.org/security/sa0810.html&gt;

Limitations

Exploit works with VLC media player 0.9.4 and requires a user to download and save the MOV and RT files in the same directory, and then open the MOV file in VLC.

Platforms

Windows 2000
Windows XP

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.97 High

EPSS

Percentile

99.8%