Date: Thu, 03 Oct 2013 22:32:12 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Pedro Ribeiro <pedrib@...il.com>, Assign a CVE Identifier <cve-assign@...re.org> Subject: Re: Re: CVE request - VLC 2.0.0 to 2.0.8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/03/2013 02:52 PM, Pedro Ribeiro wrote: > On 1 October 2013 16:20, Pedro Ribeiro <pedrib@...il.com> wrote: >> Hi, >> >> I have discovered a denial of service / possible code execution >> in VLC via a crafted ASF file. This has been reported to VLC and >> was apparently fixed unintentionally in 2.0.8 with the entry >> "Improve handling of corrupt ASF files". Version 2.1.0 is not >> affected. >> >> The file contains a crafted ASF packet that causes VLC to crash >> on a read operation, with control of EDI and EAX. In the file >> attached you will find at starting offset 0x157AD the hex values >> 17 DE B4 71 in little endian, which attempts to use for a read >> operation. Control of other variables in the Demux function in >> asf.c is also possible by changing packet values before and after >> the offset as per the ASF specification. >> >> The file is located here: >> https://github.com/pedrib/PoC/blob/master/vlc-crash.asf >> >> I have not been able to obtain any program control so far, so at >> the moment this only crashes VLC. However someone more skilled >> might be able to control it. >> >> Can you please provide a CVE for this? >> >> Regards Pedro > > > Hi, > > Do you need more information on this, do not consider it CVE-worthy > or just swamped with work at the moment? :) > > Regards, Pedro > Sorry forgot to reply. I'm not sure this is CVE worthy. In general crash bugs in services are CVE worthy, but crashes in client software are usually limited to things like email clients or web browsers where there is a high potential for processing untrusted data without much user interaction (e.g. displaying some random email or web page) whre you also have the potential to lose work (so there is an impact). In the case of VLC you load a nasty file, it crashes, you don't do it again. There's not really any impact. You don't lose any work. Now the question becomes "possible code execution" is how possible? This is based on the fact that memory corruption occurs, or is there more evidence? - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQIcBAEBAgAGBQJSTkTLAAoJEBYNRVNeJnmTl8QQALyLEkBcN6TXi6UHp19HXjfw Iigyag+FoFseJtIO1MdB8Qq4PYhLXCUJJ/6Lhe4ZLZJ3XdAQL9EjXqH2ehWfgWQh V5qnKT+wlrUb8WTrTFTiOQHzmyd/Z/Q+Sp66+OGJ2upSp0ZutA0/1WVFK6U9SE2V YEPQzgh15g8WRufiJut1y+yUpiVpoSU8XQniLTFnxROkRSMXAx4pDtILRdYPvNNv QVk3/pV+c8qJzy5T+BrC4dV2dC5gKsRZH0NZdUDU7t0Zp87AOdVEQpuZrmmjbaby 8N6/c+G70GUcZ0U0Pqsecf8UYrbD+Mw379gbZQDRFMBrZxLH4fS8i5moYnM7scsh twDQKFPZ7IwUe1cT16bFHBog9joZm+DBMk4kf96rEudhsEF8uiv+moZt0ZDAODZx 8ZQmBeFpQ+hfv8n9gkwehT4FaJ/o6kK+PHDFHOCplA5ljbFuUufg7HzSsOb8mSHV GeChKkdEbdqAFgBwIUjMgBHq47Irz4ZMgIhwni+3knczwvuhdJTFDwn777LdlbIg VjL+Ws2fTUsVFVQ7VpWwrJ24Rk3DP5dlk9BLNIGkvw6Z9fzUievwBjotdlFrwczo XyfY2bi4ms6nLGyct0L1OTwoFQ9P4NxmVSSgRNW8kZlLPmEKInpf5q990oZX3hX7 +rRU7rmQlA1pjBCxBNh1 =qnq6 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.