Bug 385953 – <media-video/vlc-1.1.12 NULL dereference in HTTP server (CVE-2010-3124,CVE-2011-1087)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sean Amoss (RETIRED) 2011-10-06 21:54:02 UTC]

From $URL:

VLC media player suffers from a NULL dereference vulnerability in the HTTP and RTSP server component.

Impact
If successful, a malicious third party could crash the server process. Arbitrary code execution within the context of VLC media player is not believed possible.

Threat mitigation
Exploitation of those bugs requires the user to explicitly start the HTTP web interface, HTTP output, RTSP output or RTSP VoD functions.

Workarounds
Where possible, limit access to the VLC server to trusted IP addresses.
Alternatively, configure a deep inspection firewall to block malformed HTTP and RTSP requests.

Solution
VLC media player 1.1.12 addresses this issue. A source code patch is also available as an alternative.

[Comment 1 Sean Amoss (RETIRED) 2011-10-06 21:57:40 UTC]

@maintainer: it looks like we have vlc-1.1.12 ebuild as ~arch. Is it ready to be tested for stable?

[Comment 2 Alexis Ballier 2011-10-07 12:23:08 UTC]

(In reply to comment #1)
> @maintainer: it looks like we have vlc-1.1.12 ebuild as ~arch. Is it ready to
> be tested for stable?

yes

[Comment 3 Sean Amoss (RETIRED) 2011-10-07 12:29:26 UTC]

Arches, please test and mark stable:

=media-video/vlc-1.1.12

Target KEYWORDS : "alpha amd64 ppc ppc64 sparc x86"

[Comment 4 GLSAMaker/CVETool Bot 2011-10-08 01:11:53 UTC]

CVE-2011-1087 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1087):
  Buffer overflow in VideoLAN VLC media player 1.0.5 allows user-assisted
  remote attackers to cause a denial of service (memory corruption and
  application crash) or possibly execute arbitrary code via a crafted .mp3
  file that is played during bookmark creation.

CVE-2010-3124 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3124):
  Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player
  1.1.3 and earlier allows local users, and possibly remote attackers, to
  execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse
  wintab32.dll that is located in the same folder as a .mp3 file.

[Comment 5 Elijah "Armageddon" El Lazkani (amd64 AT) 2011-10-08 15:30:04 UTC]

amd64: pass

NB: .la file present, I don't know if those should be fixed or not.

[Comment 6 Agostino Sarubbo 2011-10-08 15:33:57 UTC]

(In reply to comment #5)
> amd64: pass
> 
> NB: .la file present, I don't know if those should be fixed or not.

Fixed in 9999 version atm

[Comment 7 Paweł Hajdan, Jr. (RETIRED) 2011-10-08 16:42:37 UTC]

x86 stable

[Comment 8 Markos Chandras (RETIRED) 2011-10-09 13:58:21 UTC]

amd64 done. Thanks Elijah and Agostino

[Comment 9 Kacper Kowalik (Xarthisius) (RETIRED) 2011-10-09 18:55:35 UTC]

ppc/ppc64 stable

[Comment 10 Raúl Porcel (RETIRED) 2011-11-05 19:30:41 UTC]

alpha/sparc stable

[Comment 11 Agostino Sarubbo 2011-11-05 20:04:23 UTC]

Thanks folks. Added glsa request vote.

[Comment 12 Tim Sammut (RETIRED) 2011-11-06 16:26:48 UTC]

Thanks, everyone. We'll send this with the existing VLC bugs.

[Comment 13 GLSAMaker/CVETool Bot 2014-11-05 22:09:08 UTC]

This issue was resolved and addressed in
 GLSA 201411-01 at http://security.gentoo.org/glsa/glsa-201411-01.xml
by GLSA coordinator Sean Amoss (ackle).