Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 03 Oct 2013 22:32:12 -0600
From: Kurt Seifried <>
CC: Pedro Ribeiro <>,
        Assign a CVE Identifier <>
Subject: Re: Re: CVE request - VLC 2.0.0 to 2.0.8

Hash: SHA1

On 10/03/2013 02:52 PM, Pedro Ribeiro wrote:
> On 1 October 2013 16:20, Pedro Ribeiro <> wrote:
>> Hi,
>> I have discovered a denial of service / possible code execution
>> in VLC via a crafted ASF file. This has been reported to VLC and
>> was apparently fixed unintentionally in 2.0.8 with the entry
>> "Improve handling of corrupt ASF files". Version 2.1.0 is not
>> affected.
>> The file contains a crafted ASF packet that causes VLC to crash
>> on a read operation, with control of EDI and EAX. In the file
>> attached you will find at starting offset 0x157AD the hex values
>> 17 DE B4 71 in little endian, which attempts to use for a read
>> operation. Control of other variables in the Demux function in
>> asf.c is also possible by changing packet values before and after
>> the offset as per the ASF specification.
>> The file is located here: 
>> I have not been able to obtain any program control so far, so at
>> the moment this only crashes VLC. However someone more skilled
>> might be able to control it.
>> Can you please provide a CVE for this?
>> Regards Pedro
> Hi,
> Do you need more information on this, do not consider it CVE-worthy
> or just swamped with work at the moment? :)
> Regards, Pedro

Sorry forgot to reply. I'm not sure this is CVE worthy. In general
crash bugs in services are CVE worthy, but crashes in client software
are usually limited to things like email clients or web browsers where
there is a high potential for processing untrusted data without much
user interaction (e.g. displaying some random email or web page) whre
you also have the potential to lose work (so there is an impact).

In the case of VLC you load a nasty file, it crashes, you don't do it
again. There's not really any impact. You don't lose any work.

Now the question becomes "possible code execution" is how possible?
This is based on the fact that memory corruption occurs, or is there
more evidence?

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Version: GnuPG v1.4.14 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.