Security Advisory 0701

Summary           : URL format string injection in CDDA and VCDX plugins
Date              : 02 January 2007
Affected versions : VLC media player 0.8.6 down to 0.7.0
ID                : VideoLAN-SA-0701, MOAB-02-01-2007
CVE reference     : CVE-2007-0017

Details

VLC media player CDDA (CD Digital Audio) and VCDX (Video CD) plugins are prone to a C-style format string vulnerability when trying to open a media resource location. The bug occurs when handling error and debug messages from underlying library libcdio.

Because the VCDX plugins probes every media resource location unless another plugin successfully opened the resource, almost any invalid location can trigger the bug.

Impact

If successful, a malicious third party could use this vulnerability to execute arbitrary code within the context of VLC media player (i.e. acquire local user privileges on the vulnerable system), or crash the player instance.

Threat mitigation

Exploitation of this bug requires passing of a maliciously crafted media location to VLC media player. While this normally comes from trustworthy user input, it can also come from a playlist file (M3U and such), from the network through a service discovery plugin (if enabled), or embedded in a web page if VLC is installed as a browser plugin.

Workarounds

If support for Audio and Video CDs is not used, one can remove the affected plugins manually from the VLC plugin "access" directory. Relevant filenames are as follow:

Microsoft Windows

access/libcdda_plugin.dll and access/libvcdx_plugin.dll

Apple MacOS X

access/libcdda_plugin.dylib and access/libvcdx_plugin.dylib

Other (Linux, BSD...)

access/libcdda_plugin.so and access/libvcdx_plugin.so (typically found in /usr/lib or /usr/local/lib).

Otherwise, browser plugins and network-based service discovery mechanisms (SAP, UPnP, Bonjour...) should be disabled, and untrusted playlist files should not be used.

Solution

Source code patch for VLC 0.8.6 is available here (GPG signature).

VLC media player 0.8.6a, published on 4th January 2007 addresses this issue and introduces further usability fixes.

Pre-compiled packages for Mac OS X and MS Windows are available at the usual download locations.

Linux and BSD users should get relevant software upgrades from their respective distribution/OS vendor.

Landon Fuller has reportedly released a patch for VLC 0.8.6 on MacOS X, however the VideoLAN project cannot make any statement on its accuracy at the moment.

Credits

This bug was publicized and reported by Kevin Finisterre as part of the Month Of Apple Bugs activity.

References

Initial bug report

http://www.via.ecp.fr/via/ml/vlc-devel/2007-01/msg00005.html

Initial patch

https://code.videolan.org/videolan/vlc/-/commit/7e501d16ee2d458990cf27ac7d332572c91df856

VLC 0.8.6 official source code patch

http://www.videolan.org/security/patches/vlc-0.8.6-MOAB-02-01-2007.patch

http://www.videolan.org/security/patches/vlc-0.8.6-MOAB-02-01-2007.patch.asc

The VideoLAN project

http://www.videolan.org/

Public announce

http://applefun.blogspot.com/2007/01/moab-02-01-2007-vlc-media-player-udp.html

Month of Apple Bugs

http://applefun.blogspot.com/

MacOS X patch from Landon Fuller

http://landonf.bikemonkey.org/code/macosx/MOAB_Day_2.20070103045559.6753.timor.html

History

05 January 2007

Added CVE candidate ID reference

04 January 2007

VLC 0.8.6a bugfix release

Binaries for Windows and MacOS X

03 January 2007

Initial advisory

Patch provided against VLC 0.8.6 source code

02 January 2007

Patch applied to VLC development tree

Bug reported and publicized by Kevin Finisterre