Signature Detail
Short Name |
HTTP:STC:DL:VLC-MATROSKA |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
VideoLAN VLC Media Player Subtitle StripTags Heap Buffer Overflow |
Release Date |
2011/07/11 |
Update Number |
1952 |
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: VideoLAN VLC Media Player Subtitle StripTags Heap Buffer Overflow
A code execution vulnerability exists in VLC Media Player. The vulnerability is due to insufficient input validation in the StripTags() function when processing strings with an opening "<" without the terminating ''>''. An attacker can exploit this vulnerability by enticing a user to open a specially crafted Matroska file with an affected version of VLC Media Player. In attack scenarios where code execution is successful the behaviour of the target machine is dependent entirely on the logic of the injected code, which will run within the security context of the target user. When code execution is not successful the affected application may terminate abnormally.
Extended Description
VLC media player is prone to a heap-based memory-corruption vulnerability. Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
Affected Products
- Pardus Linux 2009
- VideoLAN VLC media player 1.1.0
- VideoLAN VLC media player 1.1.1
References
- BugTraq: 46008
- CVE: CVE-2011-0522