Date: Thu, 26 Aug 2010 09:58:24 +0200 From: Geoffroy Couprie <geal@...eolan.org> To: oss-security@...ts.openwall.com Subject: Re: CVE request: VLC media player - DLL preloading vulnerability On Thu, Aug 26, 2010 at 1:56 AM, Steven M. Christey <coley@...us.mitre.org> wrote: > > We will have one CVE per vulnerable application. Yes, it's going to be very > painful. Roughly, the rationale is: "the product does not protect against a > common configuration/behavior in its environment." > >> VLC was exploitable by loading wintab32.dll, a component request by >> Qt, as shown in http://www.exploit-db.com/exploits/14750/ > > Use CVE-2010-3124 Thank you. > > >> There's another possibility with DMO. > > Is this a distinct product outside of VLC, or is it just a different > component / attack vector? > DMO stands for DirectX media objects. These are the codecs and video filters used in DirectShow. So, potentially, all the applications using external codecs or filters are vulnerable. And the issue with wintab32.dll is caused by Qt, so developers using Qt should check their applications. Best regards, -- Geoffroy Couprie http://unhandledexpression.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.